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PREFACE 


Part I provides an outline ol i:\ie Panel's most significant ob- 
servations and assessments based on fact-finding inspections this past 
year. 

This volume, Part II, summarizes the Information developed dur- 
ing these fact-finding Inspections. It is organized along the lines 
of the Panel's eight Task Teams. The team approach was used this 
year to enable the members to focus on areas of Shuttle critical to 
mission reliability and crew safety. The intent here is to provide 
the reader with both (a) an accurate description of the data examined 
including its relevance to the achievement of a safe and successful 
mission, and (b) a status report on each area with particular atten- 
tion to the resolution of technical and managment challenges. 

Part II of this volume when used with the related portions of 
the Panel's last Annual Report (June 1975) provides the reader with 
substantial background on the Space Shuttle's design and expected 
performance, and many of the critical management systems and organ- 
izations. Since the Panel's reviews are ciumilative, the statement 
in last year's Annual Report continues to be true: "This material will 
be utilized by the Panel in further reviews during the coming year as 
a baseline and reference manual." 
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1.0 INTRODUCTION 


1.1 Operational ttode 

The Panel's operational mode since Its inception has been to 
conduct monthly Inspections by the full Panel. These are held at 
both NASA and contractor sites. With the completion of the Apollo 
Soyuz Test Project in July 1975, the Panel was able to focus on 
the Space Shuttle. As a result, the Panel agreed that they would 
augment the full Panel inspections with individual fact-finding 
in areas requiring more intensive review. Thus the Panel held in- 
spections and/or reviewed data at Rockwell International, Downey, 
California on October 29-30, 1975, at Monsanto Research Corporation 
in St. Louis, Missouri on December 8, 1975, and at tli:: Johnson 
Space Center, Texas on February 9-10 and May 24-25, 1976. Members used the 
time normally allocated for full Panel -(nspectlons in September, 

November, January and March for fact fitK-ing research. 

1.2 Operational Scope 

The Panel's use of a "task team" fact-finding approach as well 
as full Panel Inspections enables the Panel to cover a large number 
of significant tasks in much greater depth while continuing to monitor 
the status of the program as a whole. The task areas have been stated 
in broad terms so that each member can define the specifics of his 
task based on his analysis of the situation. The task areas are: 
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A • 

Systems Integration and Technical Conscience* 


b. 

Space Shuttle Main Engine (SSME). 



c. 

Avionics and its Management System* 



d. 

Risk. Management . 



e. 

Ground Test Program and Ground Support Equipment. 


f. 

Flight Test Program (Approach and Landing, 

Orbital, 

Ferry) . 





g« 

Orbiter Thermal Protection System. 



h. 

External Tank Program and the Solid Rocket 

Booster 

Program. 





Panel members have assigned themselves to more than one task 
team to reflect the Interdependence or commonality between task 
areas. In each team one member has accepted responsibility for the 
team product to assure clear accountability. 

The task teams use a variety of ways to obtain the information 
they feel is necessary to the completion of their tasks. In addition 
to specific fact-finding visits to the NASA Centers and contractors, 
they have been attending various in-house reviews as well. These 
include Quarterly Status Reviews and System Design Reviews. Also, the 
Panel uses telephone conferences and correspondence with the program 
offices to assure a thorough understanding of the area under con- 
sideration. This also provides the Panel's conclusions and recom- 
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mendatlon to the program organizations so that they may make use of 
the Panel's findings as quickly as possible. 

Full Panel Inspections provide the forum for members to share 
their findings and observations. 
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2.0 SYSTEMS MANAGEMENT 


2.1 Introduction 

The Panel reviewed those management functions which integrate 
the project management elements into a program management system and 
assure Integrated flight hardware and software systems. Particular 
attention was given to those management functions which provide a 
check and balance on the various project elements and assure a tech- 
nical conscience. The Panel's last annual report recommended that 
the "check and balance" capability be further strengthened. The pro- 
gram's response to this recommendation is included as Attachment 2-1. 
The NASA Deputy Administrator asked the Panel to continue this re- 
view of the evolution of these management functions to assure that 
the program continues to develop a management capability appropriate 
to the challenge of this program. 

Systems management as used here includes the following manage- 
ment functions : 

a. Systems integration refers to the management functions 
which provide for systems engineering, technical integration, and test 
and ground operations. These management functions include the pro- 
gram level office for systems integration and a large number of 
technical panels 

b. Technical conscience refers to those forums which pro- 
vide people throughout the organization suitable opportunities to 
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express their concerns to management. The Panel and review systems 
are classic examples. 

c. Check and balance refers to the technical management 
capability outside of these day-to-day operations to provide Independent 
assessments on key technical and management Issues. The new technical 
assessment groups are an example. 

2.2 Systems Integration - NASA 

The systems Integration office Is Involved In defining Shuttle- 
wide requirements such as (1) the flight dynamics, loads and structural 
dynamics environment for the total vehicle, (2) the design require- 
ments for such Shuttle wide flight systems as propulsion and avionics, 
and (3) common requirements and specifications for materials, pro- 
cesses and manufacturing. They are also Involved In managing the 
systems for development of the Shuttle specification and Interface 
documents and monitoring the activities of the individual elements to 
meet these specifications. They develop trade studies and assessments 
of proposed engineering changes that affect more than one element as 
well as participate in working problems that are faced by more than 
one element. 

The office faces a large responsibility and workload and so they 
have augmented their capability by establishing a systems integration 
support contractor, and developing a system of inhouse panels and 
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system management reviews, liielr approach Is to develop a system 
which bring? together knowledgeable engineering and other personnel 
from the "line" organizations to work common problems and critique 
each others efforts and then to manage this system by chartering 
each group, defining its task/product, and evaluating its processes 
and results. This also assures efficient use of manpower while 
giving up some degree of "independent assessment" capability. Among 
the major management steps this year, MSFC established a Space Shuttle 
Main Propulsion System Integration Office to review and evaluate the 
plans and activities for the design and verification of the Individual 
elements and assure that there is an adequate basis for confidence in 
the end-to-end system from the External Tank to the SSME nozzle. 

A "systems engineering plan" is also to be released this year. 

It will be the single source document on how the systems engineering 
function in the program is being implemented: (1) what needs to be 
done, (2) who is doing it, (3) how is it being accomplished, and 
(4) when it needs to be done. The main text will have the data on 
the management organizations roles and responsibilities, management 
techniques and Interfaces, task descriptions and Implementation, and 
the expected products and documentation. Appended to this main text 
will be a set of sub-plans detailing major integrated areas of concern, 
e.g., Integrated schedules, flight performance, loads and dynamics, 
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guidance, navigation and control. 


2.3 Systems Integration - Support Cot'>*‘ractor 

The contractor has two principal tasks; (a) to assure compatibil- 
ity of hardware and software for form, fit and function of elements, 
ground support and facilities, and (b) assure that there Is known 
compliance with the design requirements and performance requirements 
from a systems viewpoint. This Is In effect an expanded configuration 
control system across the entire program. 

The role and principal functional areas involved In this work are 
as follows: 

a. Design engineering deals with subsystem and ground 
system compatibility along with related software and test require- 
ments . 

b. Systems engineering covers mission and operations 
analysis, trajectory analysis along with thermal analysis and re- 
sultant requirements, and flight dynamics requirements. 

c. Design integration provides requirements allocation, 
interface analyses and requirements between hardware and software 
between all elements of the Shuttle system, and the attendant soft- 
ware, requirements, change analysis to support program and element 
change control board operations. A special area is the integration 

of measurements and stimuli for both ground and flight tests and operations. 
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d. Maintainability seeks to assure that the many elements of 
the system can be serviced and maintained In the shuttle operational 
phase once >-he DDT&E program is complete. 

Their activities support and help to produce such Items as; 

a. System Requirements Definition . The JSC 07700, Level II 
documents, "Space Shuttle Level II Program Definition and Requirements" 
and the "Shuttle Master Verification Plan," Volumes I and II. 

b. Requirements Analysis . The Contract End Item Specifi- 
cation, Requirements Definition Documents, Volume III of the Master 
Verification Plan "Orbiter Verification Plan," Test Requirement Require- 
ments' Specifications, Test Flans, Shuttle Operational Data Book 

c. Integration Analysis . Integrated schematics. Inter- 
face Control Documents (ICD's) for Level II (across elements). 

Master Measurements List. 

d. Compatibility Analysis . Problem reports and their 
resolution. 

2.4 Technical Conscience - Technical Panels 

The Systems Integration Office identifies the needs for a panel, 
charters it and defines the task/product. The engineering organization 
staffs it, defines the approach and implements it. Over the years 
the number of panels has grown until there is now at least fifty-four 
panels. Since these are listed in Attachment 2-2 and the directives 
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spell out in considerable detail the purposes, responsibilities and 
procedures the work o£ the individual panels is not described here in 
detail. However, one case study is cited here to Illustrate how the 
system operates. 

The Manager for Systems Integration is responsible for the in- 
tegration of propulsion and fluid systems. He in turn has delegated 
responsibility to the Manager, Systems Engineering Office. The 
Systems Engineering Manager has established a technical manager for 
this area and the principal mana,%ement mechanisms to help him. These 
include the Main Propulsion System Panel and coordinators to support 
the manager in the areas of integration of the solid propulsion system 
and integration of the auxiliary propulsion and fluid systems with 
other elements of the Shuttle, The Main Propulsion System Panel is 
responsible for assuring sufficient detailed understanding of the 
total vehicle to recommend specific overall vehicle requirements, allo- 
cation of these requirements to each major element and the interface 
relationships between elements. The panel by continuous assessment 
insures that test results satisfy sjfstem performance requirements. 
Through its periodic technical reviews and studies the panel identi- 
fies problems, determines corrective action and recommends such action 
to the technical manager. The systems engineering office maintains 
contact with the operation of this management system through a desig- 
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nated liaison officer. 


Earlier it was noted that technical conscience Implies suitable 
forums for knowledgeable personnel to raise questions and critique 
each others work. Many panels by their intercenter and interdisci- 
plinary membership are such forums. The Crew safety Panel is a classic 
example. The panel is chartered to assure (1) development of crew 
safety and crew-vehicle risk assessment requirements for the Shuttle 
and all its mission phases, (2) identification of individual and inte- 
grated subsystem failure modes and hazardous operating conditions which 
might lead to loss of vehicle or crew, and then (3) identification of 
modifications in hardware, software, and procedures to reduce or 
resolve these hazards. Thus they have both policy and operating 
responsibilities. The membership illustrates the scope of the panel 
as a forum for it is not limited to safety personnel, tfembers are 
drawn from the disciplines represented by the Systems Integration 
Office, the Operational Integration Office, the Orbiter Project Office, 
Engineering and Development Directorate, Data Systems and Analysis 
Directorate (software) Flight Operations Directorate and Life 
Sciences Directorate. In addition each of the three manned flight 
centers, as well as the Dryden Flight Research Center with its 
experience in experiemental aircraft and lifting bodies and the Air 
Force have members on this panel. 
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The Systems Integration Office continues to review the structure 
of the system as well as the operation of individual panels so they 
can a<^apt the system to current requirements. This past year they 
completed a comprehensive review and consolidated some panels where 
their activities had turned out to be interdependent. For instance, 
the avionics panel now has responsibility for lightning and EMI effects 
since avionics may be vulnerable to them. They also identified new 
needs and established the Ascent Flight Systems Working Group as a 
senior management group responsible for the trade-offs between the 
Integration of the individual flight systems that are critical during 
the ascent phase. 

The Panel monitors the operation of this system by evaluating 
the role and contribution of individual panels in areas under review 
by panel members such as propulsion, avionics and crew safety. 

2.5 Technical Conscience - The Review System 

The review system also provides a number of forums to bring to- 
gether knowledgeable people to raise and work concerns rather than let 
them slip by without the appropriate management attention. 

The Shuttle Program Manager has the responsibility to control 
and manage the overall Integration of the vehicle. His personal 
management tool is the Program Requirements Control Board. The delib- 
erations of this board are supported by the activities and resultant 
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Information provided by the Systems Integration Review (SIR) tech- 
nical management system. 

The sir's, chaired by the Manager for System Integration, are to 
assure that specifications are in fact defined and met. Tl\ese specifi- 
cations may be for various areas of the environment such as the ascent 
phase or such integrated systems as avionics and propulsion. Here 
is a list of the functions to be accomplished by the SIR's. 

a. Specification of the ascent flight vehicle systems 
integrated performance requirements for the Shuttle system and the 
analysis of integrated vehicle design and test data to assure com- 
pliance and compatibility. 

b. Specification of the flight performance requirements 
for the Shuttle, system and the analysis of element design and test 
data to assure compliance and compatibility. 

c. Specification of the loads and structvjral dynamics 
requirements for the Shuttle system and the, analysis of element de- 
sign and test data to assure compliance and compatibility. 

d. Specification of the guidance, navigation and control 
system performance requirements for the Shuttle system and the analysis 
of element design and test data to assure compliance and compatibility. 

e. Specification of the integrated avionics requirements 
for the Shuttle system and the analysis of element design and test 


12 


data to assure compliance and compatibility. 

f. Specification of the Integrated propulsion system 
and fluids requirements for the Shuttle system and the analysis of 
element design and test data to assure compliance and compatibility. 

g. Specification of the requirements for the Integrated 
vehicle attachment, release, av'd ‘vparatlon systems and the analysis 
of element design and test data to assure compliance and compatibility. 

h. Specification of the Integrated thermal design require- 
ments for the Shuttle system and the analysis of element design and 
test data to assure compliance and compatibility. 

1. The development of element- to-element and element-to- 
ground Interfaces and preparation of necessary documentation. 

j. Specification of ‘ the ground operations requirements 
for landing, turnaround, launch preparation, and major ground test. 
Including GSE and facilities, and analysis of element design and 
test data to assure compliance and compatibility. 

To exercise control over such a wide range of functions the 
systems integration office found it necessary to establish technical 
managers for specific areas. Thus there are managers for flight 
performance, loads and structural dynamics, flight control integrated 
avionics. Integrated propulsion and fluids, mechanical systems, 
system interfaces, thermal design integration and ground operations. 
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The membership o£ the SIR Board Is composed o£ these tech, ical 
managers as well as representations £rom a variety o£ organization 
to assure all in£oicmed viewpoints are represented. Thus there are 
representatives from: 

Space Shuttle Program Systems Engineering Office, JSC 

Space Shuttle Program Operations Integration Office, JSC 

Space Shuttle Program Management Integration Office, JSC 

Space Shuttle Program Resources and Schedules Integration 
Office, JSC 

Engineering and Development Directorate, JSC 

Office of Aeronautics and Space Technology, NASA Headquarters 

Space Shuttle Projects Office, Engineering Management Office, MSEC 

Science and Engineering, System Analysis and Integration 
Laboratory, MSEC 

Science and Engineering, Systems Dynamics Laboratory, MSEC 
Space Shuttle Projects Office, KSC 
Orbiter Project Office, JSC 

Space Shuttle Main Engine Project Office, MSEC 
External Tank Project Office, MSEC 
Solid Rocket Booster Project Office, MSEC 
Rockwell-Space Division 

In addition to these reviews the Systems Integration Office mon- 
itors technical progress through attendance at such project reviews 


U 


as the ALT design review and the Orbiter 101 and 102 design review. 
Itiese reviews bring together the knowledgeable people to critique 
each others work and raise issues. Issues that cannot be resolved 
at one level are referred to a higher level of management. Manage- 
ment also has the opportunity to review significant decisions made 
at the lower levels. 

For instance, the Approach and Landing Test Critical Design 
Review completed in April covered in detail the test and test support 
operations to be performed, the facilities and equipment to be used, 
and the management and working relationships of the test organizations 
conducting the approach and landing test program. Further, the ALT 
Critical Design Review covered the activation of the ALT eapabili^iy, 
the conduct of the test program itself, and the deactivation of the 
program. 

The design and manufacturing status reviews for a vehicle en- 
ables people to express their concerns about individual flight and 
ground systems as well as the status of systems integration and 
reliability, quality and safety work before proceeding to the next 
phase. These concerns, expressed in the format of RIDs, are officially 
tracked and formally dispositioned. To give the reader a sense of 
the issues raised and worked through this system, there were 2400 RIDs 
identified through the Preliminary and Critical Design Reviews and 
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Customer Acceptance Reviews on the first flight vehicle 101. Almost 
all have been worked and closed at this time. 

The Panel monitors this area actively by attending selected re- 
views to evaluate the process as well as issues and their resolution, 

2.6 Check and Balance - The Technical Assessment Groups . 

It is through the system of technical panels and reviews that 
technical conscience can find its expression and because people from 
differing backgrounds can critique one anothers work there is a check 
and balance and independent assessment process at work. The Panel's 
recommendation was that this process be further strengthened by per- 
sonnel outside day—to— day responsibility for the program. This last 
section describes what the Panel found this year. 

Technical Assessment Offices have been established at each of 
the three manned flight Centers and Rockwell. These are small, well- 
knit groups of highly skilled engineers who are on the lookout for 
problem areas to prevent any significant problems from "falling 
through the crack." Tl\ese personnel stay abreast of the program and 
determine their task areas by participating in day-to-day discussions 
with subsystem managers and working level reviews and discussions 
using their own personal experience for lessons learned that may be 
applicable to the current situations. 

The program assessment offices are set up as follows: 
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a. JSC - The office reports to the Shuttle Program Manager 

and Center management. It defines Its own tasks. It has been functioning 
the Longest of the Center offices and has made substantial contribution 
In such areas as avionics and contingency abort requirements. Currently 
It has about ten specialists. 

b. MSFC - The office reports to the Associate Director, 

Science and Engineering, and Is particularly active In assuring Inte- 
gration of flight systems Involving more than one project office. 

Thus they are actively Involved In the work of the Main Propulsion 
Test Office and Ascent Flight Systems Integration Group. They are 
still In the process of staffing. 

c. KSC - The office reports to the Manager, Shuttle Project 
Office and is staffed by experienced trouble shooters. The office is 
still in the process of staffing and getting fully underway. 

d. Rockwell International - The Vice President identifies 
critical areas where foresight and planning now can preclude problems 
downstream and he staffs as he Identifies the need and therefore the 
expertise required. 

So the groups are in place and beginning to function. Next year's 
report will report on their evolution and their contributions. The 
Panel monitors this system by working with these groups. 
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ATTACHMENT 2-X 


Systems Integration management needs to strengthen "check and balance" 
capability. 

Response: This comment is similar to that made by the Hawkins team. 

The actions that have been taken include: 

a, A special group has been established at JSC to provide an 
overview of the system engineering/ integration function and will 
report directly to R. F. Thompson, Program Manager. 

b, Effort and scope have been increased on the Rl/SD contract 
for system evaluation. A few highly competent individuals are be* 

ing assigned to provide independent assessments and will report directly 
to W. Dean, V.P., Systems Integration. The scope of this activity 
specifically includes problem evaluation and avoidance options, trades, 
and alternatives; technical and programmatic interrelationships; and 
contingency planning. 

c. A review of the JSC/MSFC panel relationships has been com- 
pleted and selective changes in membership and panel structure are 
being made to improve integration across Genter/Project interfaces. 

d. Program and system level planning is being developed in more 
detail and will provide more visibility and support to the integration 
management and decision making process. 


ATTACHMENT 2-Z 


SPACE SHUTTLE PROGRAM DIRECTIVES 
THAT ESTABLISH PANELS, WORKING 
GROUPS AND SIMILAR OPERATIONS 


Directive No. * Subject 

1 Simulation Planning Panel (for simulation activities) 

4 Crew Safety Panel 

6 Configuration Management Panel 

8 Ground Interface Working Group 

9 Crew Procedures Control Board 

11 Information Management Systems Panel 

14 Systems Integration Reviews (SIR) 

15 Payloads Interface Panel 

17 Program Management Information Center Integration Panel 

18 Program Performance Management Panel 

21 Flight Test Program Panel 

22 Electromagnetic Effects Panel 

23 Flight Performance; 

23.1 Ascent Performance Panel 

23.2 Integrated Entry Performance Panel 

23.3 Abort Performance Panel 

23.4 Separation Performance Panel 

23.5 Aerodynamic Performance Panel 

24 Main Propulsion System Panel 

25 Loads and Structural Dynamics 

25.1 POGO Integration Panel 

25.2 Loads and Structural Dynamics Panel 

25.3 Ground Vibration Test Panel 

25.4 Particles and Gases Contamination Panel 

26 Mechanical Systems 

26.1 Spacecraft Mechanisms Panel 

26.2 Shuttle Vehicle Attachment and Separation SUBpancl 

26.3 Payloads Docking, Retention, and Deployment SUBpanel 

26.4 Landing Systems and facilities SUBpanel 

27 Shuttle Training Aircraft (STA) Review Board 

29 Communications and Data Systems Integration Panel 

' 29.1 Functional Requirements SUBpanel 

29.2 Vehicle Communications Interface SUBpanel 

29.3 Ground Based Data Systems SUBpanel 

29.4 Science and Engineering Data Processing SUBpanel 

30 Flight Operations Panel (FOP) 

31 Operations Integration Review (OIR) 

33 Computer Systems Hardware /Software Integration Review (CSIR) 

36 Training Simulator Control Panel 

* Latest Issue 
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ATTACHMENT ?-2 (Continued) 


Guidance, Navigation, and Control Integration 

39.1 Ascent Flight Control/Structural Integration Fanel 

39.2 On-Orbit Guidance, Navigation, and Control Panel 

39.3 Entry Guidance, Navigation, and Control Panel 

39.4 Guidance, Navigation, and Control System Panel 
Safety, Reliability , and Quality Assurance Management Panel 
Procurement Integration panel 

Integrated Avionics Technical Management Area 

45.1 Shuttle Avionics Panel 

45.2 Flight Communications Panel 

45.3 Shuttle Avionics Checkout Panel 

45.4 Avionics Verification Panel 
Thermal Design Integration 

46.1 Thermal Control Panel 

46.2 Thermal Protection Panel 

COD Shuttle Requirements Review Panel 
Communications and Tracking Systems Ground Test Panel 
Operations and Maintenance Requirements and Specification 
Control Board 

Ascent Flight Systems Integration Group 

Integrated Logistics Panel 

Resources and Schedules Management Panel 


3.0 SPACE SHUTTLE MAIN ENGINE (SSME) 


3.1 Introduction 

The Panel has given special attention to the challenges during 
the past few years, the concerns expressed by NASA management, and 
the fact the engines are critical to the accomplishment of the Shuttle 
missions. Specifically, the areas under current review are: 

a. The use of new and In many cases unproven technology. 

b. Adequacy of design margins to meet the requirements 
for repeated use. 

c. Ability of the engine electronic controller to accom- 
modate the environment and needs of the engine and the total Shuttle 
system. 

d. Results of credible failures. 

e. Hardware availability and the test program require- 
ments. 

The Panel considered the Impact on the hardware and software develop- 
ment program of both (a*) cost and schedule constraints, and (b) the 
numerous Interface requirements Involving other Shuttle elements such 
as the Orblter, Solid Rocket Booster, Ground Support Equipment, and 
External Tank. 

In meeting the objectives of this task the Panel and the task 
team has relied on briefings, face-to-face discussions with NASA and 
contractor personnel, participation In In-house reviews, and review 
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of relevant documents. A part of this effort is a followup on 
open items i.n the NASA Shuttle Program Qffice's response to the 
Panel’s annual report The Program's responses to the last annual 
report on the ngine is Included as Attachment 3-1. This material 
reflects the degree to which analyses and test programs have evolved 
in providing answers to challenges in the areas of materials be- 
havior under severe environments, weldments, POGO suppression, and 
controller performance. 

A brief look at the Level I (NASA Headquarters) controlled mile- 
stones are valuable for they show the program's progress and the work 
ahead . 


- Completed first prebumer test Accomplished April 1974 

- Began fabrication of Main Propulsion Accomplished May 1975 

Test Article (MPTA) Engines for the 

integrated test of the toal system 

- Completed first integrated Subsystem Accomplished June 1975 

test 


- Complete first SL firing for a Scheduled for Feb. 1976 

minimum of 60 seconds at Rated Power 
Level 


Complete first throttling test (MPL- 
RPL) 


Scheduled for Mar. 197b 


Complete SSME "all-up" throttling test Scheduled for Sept. 1976 


- Critical Design Review (CDR) 

- Delivery of Main Propulsion Test 
Engines (3 of) to NSTL 


Scheduled for Sept. 1976 
Scheduled for May 1977 
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- Deliver first flight engines (3) Scheduled for Aug. 1978 

- Conduct first manned orbital flight ScheduJ d for Mar. 1979 

3.2 Observations 

There have been a number of changes in the Rocketd 3 me organi- 
zation since last year's annual report. This is readily seen from 
the comparison of organization chart'' from September 1974 and October 
1975 (Figures 3-1 and 3-2). These changes continue to strengthen the 
program management system. For Instance an Associate Program Manager 
has been appointed for the engine controller and the engineering 
areas have been "beefed-up." Mr. Norman J. Ryker was appointed 
President of the Bccketdyne Division. 

3.2.1 Review System 

The management system holds a number of reviews on a regular 
basis. The Quarterly Technical Review for MSFC Senior Management 
and weekly telecons are two examples. In addition, a special SSME 
Design Margin Review was conducted in July 1975. Prior to this 
Design Margin Review, there had been a general concern about the 
safety factors on many of the components. The margin review showed 
that most of the components actually had more than the minimum 
safety factor of 1.4. 

Attendance at SSME reviews and discussions with both NASA and 
Rocketdyne personnel indicate that the review system is working well 
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in that it provides a forum for frank discussions of technical md 
management areas and pro'^'ides necessary information on costs, 
schedules, and technical performance for day-to-day work and decision- 
making . 

To further assure that nothing "falls through the crack," a 
technical assessment group has been established and is now being 
staffed. A Space Shuttle Main Propulsion Systems Integration 
Office was recently established at the Marshall Space Flight Center 
to serve as the responsible body for the review and evaluation of 
Ms.ln Propulsion System design criteria and to assure compatibility 
of Level Il/Level III design and performance requirements. They 
are responsible for the definition and compatibility of mechanical, 
structural, electrical and fluid interfaces, and design verification 
of the system. 

JSC established a technical manager's position in mid-1974 to 
oversee the integrated propulsion and fluids technical management 
areas (Program Directive 24). 

To support the Technical Manager they also established the Main 
Propulsion System Panel. Finally, they appointed a Solid Propulsion 
Integration Coordinator and an Auxiliary Propulsion Coordinator. The 
Aerospace Safety Advisory Panel's interests are (a) the Propulsion 
Panel's achievements in identifying incipient failures including the 
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means by ^Ich early clues to such failures may be determined, and 
(b) the extent to 'which prior review RID's remain open, are delin- 
quent or have some further impact not identified previously. 

3.2.2 Design Progress 

Previously the Panel had raised some questions in the follow- 
ing four areas: 

a. Allowable SSME Heat Exchanger Oxidizer Coll Leakage Rate. 

b. Use of Teflon Balls in POGO Suppressor Unit. 

c. Delays in Receiving and Testing of SSME Components. 

d. Data on SSME Controller. 

The Program's response to the Panel's concerns are shown in Attach- 
ment 3-2. 

The Panel was one of those groups Interested in getting definitive 
data on the component design margins to assure that, from a structural 
and thermal standpoint, the SSME was designed to meet the environ- 
mental and time requirements Imposed by the overall Shuttle program. 

The SSME Design Margin Review established the following points: 

a. The structural and thermal audits indicated that the 
current analyses were extensive and technically sound. A few items 
required further analyses, such as the low pressure oxygen turbopump 
housing. An example of the factors of safety arrived at during these 
analyses is shown in Table 3-1. As used on the SSME the definition of 
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factor of safety is Failure Load . This accounts for those data points 

Limit Load 

falling within 2«"on the pressure and 3^on vibration. 

b. Many of the design requirements of "one engine out" 
conditions are still under analysis and test. Consideration has to be 
given to the expected impact on both the engine that goes out and the 
other two engines which continue to operate. The following state- 
ments are a summary of what we understand the situation to be. It 

is known that a non-thrusting or shut-down engine will not be cooled 
sufficiently during ascent so that the engine nozzle yill have to be 
replaced before another mission. This is based on analyses that show 
a nozzle metal temperature of about 1600° F. versus an allowable of 
1200° F. The engines are designed to provide for sensing of critical 
parameters. The current challenge is to develop the engine controller 
and the Orbiter flight control procedures that will safely shut an 
engine down without damage to the other engines or the Orbiter. 

c. This review produced a number of recommendations and 

action items that are currently under active consideration. Among 
the major ones are: (1) develop data review methods that can be 

used to identify incipient failures and devise a solution that is 
practical within cost, schedule and value received boundaries, (2) 
use maximum throttling ramp rate, (3) limit thrust for early flights 
to rated power level thereby achieving additional factor of safety 
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(See Table 3-1), (4) continue to obtain materials properties to assure 
understanding of the SSME hardware In various environments and In 
light of life requirements, and (5) Increase hardware confidence by 
conducting tests at higher pressure and temperature levels with added 
Instrumentation. 

d. Other recommendations Include. (1) Increase confidence In 
structural margin by specific burst tests throughout the program, 

(2) improve fabrication producibility and thereby confidence in the 
margins of the engine nozzle, the lines and ducts, the hot gas mani- 
fold liner and the injector, and (3) improve post assembly Inspection 
procedures , 

3.2.2. 1 Mass Properties 

As in every element of the Shuttle program both the weight 
specified vs. actual weight and the inertial properties are watched 
closely for their impact on performance and payload capability. 

While weights are discussed In terms of an Individual engine weight, 
it Is Important to remember that these numbers must be multiplied 
by three since there are three engines on each Orbiter if one is to 
appreciate the full impact of any design changes. The program monitors 
three weight values - the contract end item (CEI/ value, the design 
goal wei^t which is 99.5% of CEI weight, and the control limit 
weight used to manage the growth rate of the development weight 
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throughout the program. The table below indicates the latest weight 
conditions at the time of the Panel’s review in January 1976. 

Specification Weight (CEI) 6445 lbs. (Dry) 6892 lbs. (Burnout) 
Current Weights 6348 6790 

Contingency (lbs/%) .97/1.5 102/1.5 

This would indicate that stringent controls must be used to assure 
that by the time of the SSME CDR in September 1976 the weights are 
still within the specified limits, always keeping in mind that one 
pound overweight on an engine is in effect three pounds overweight 
for the Shuttle Orbiter and system. 

3. 2. 2. 2 Engine Integration 

Not only must the many engine components be designed, assembled 
and operated as a system, but the engine and its controller must in 
turn be a part of a well-designed and operable Main Propulsion System 
within the Shuttle total vehicle. The Main Propulsion System (MPS) 
includes the External Tank (ET) , the Space Shuttle Main Engines, pro- 
pellant feed, propellant fill and drain, propellant conditioning and 
pressurization control and purge and the Orbiter interface components. 
This overall system is shown in Figure 3-3. The following is a brief 
description of how the MPS operates. The ET provides 1.55 million 
pounds of usable ascent propellants to the SSME's. Following engine 
thrust build-up, tank pressure is maintained with vaporized propellants 
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extracted from the engines. The ET ullage pressures during boost are 
maintained at 20-22 psla In the LOK tank and 32-34 psla In the liquid 
hydrogen tank. Pneumatics are supplied by a 4000 psl helium storage 
system vlth 750 psl regulation. The helium Is used for valve actu- 
ation, SSME purge and backup shutdown, expulsion of residual pro- 
pellants after main engine cutoff. Hie propellant management con- 
trols propellant loading and a low level cutoff which Is a backup to 
the normal velocity cutoff. 

The Panel Is reviewing the SSME Interface to assess whether (1) 
there Is compatibility between the SSME requirements and the MPS, (2) 
the system/ subsystem test programs demonstrate hardware integrity and 
capability to meet system level requirements, (3) there Is schedule 
compatibility between the design, development and test activities and 
the availability of hardware , and (4) there Is the necessary degree 
of management and technical liaison between various elements In- 
volved In the MPS on Issues related to the SSME. While the Panel, 
Including Its task team, has not completed Its review. Its obser- 
vations to date are noted In both Volume I of this report and in the 
following sections dealing with the SSME components and assemblies 
and systems testing. Requirements compatibility will be examined 
later and the Integrated test program will be examined in more detail. 
Part of this work will be accomplished by participation In Ascent 
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Systems Design Review Panel operations which are conducted periodically. 
The last ones were on January 14, 27, and 28, 1976. This was the 
third such review conducted for the First Orbital Flight Test (OFT-1). 

3 . 2 . 2 . 3 . SSME Redundancy Management Requirements 

Redundancy management deals with control and declslon-maklng 
necessary to assure the ability of the system to accommodate failures 
and operate properly. Terms used in this area are defined in Table 3-2. 
With regard to the SSME the Redundancy Management Requirements have 
been stated as follows: 

a. Fall-Safe Design in the Propulsion System . In the 
event of any single failure In a functional component, the engine 
shall be capable of shuting down in a manner which will not damage the 
neighboring systems. 

b. Fail-Safe Design for Electrical Assemblies . All elec- 
trical critical subsystems shall be fail-operational after the first 
failure and fail-safe after the second failure. 

Implementation of these requirements can best be demonstrated 
by looking at typical designs. For the fail-safe design, shutdown 
of the hydraulic system occurs when a specified limit is exceeded 
such as pump overspeeds, turbine over- temps, loss of high pressure 
oxy^n burbopump seal pressure or ignition pressure that is either too 
high or too low. Shutdown of the pneumatic system occurs when there 
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is a loss of both elactrlcal/data busses for over 50 milliseconds 
or with the loss of both segoteuts of the engine electronic controller 
unit. As currently set up the OrViter can Inhibit all the sensors 
except the ignition pressure detection device and thus has an over- 
ride capability. To meet the fail operationally/ fail safe criterion 
redundancy has been provided for all critical electrical subsystems, 

A part of this fall op/fall safe design is the electrical hold-cap- 
ability to control tc the ’’last” valve position command and a hy- 
draulic hold capability to continue operation at the last valve 
position, VAien there is a loss of vehlcle/englne commands the system 
will continue operation at the last valid command and if necessary 
shutdown the vehicle. The comparison of thrust versus time for hy- 
draulic and pneumatic shutdown are shown in Figure 3-4, 

3, 2. 2,4 Engine Controller 

The Panel continues to give the Controller particular attention. 
From the standpoint of design and development testing, the Controller 
posture at this time is very encouraging. The major areas reviewed by 
the Panel included the latest design configuration, test program and 
results, software and the integration of the Controller into the SSME 
and Orbiter systems. In addition the SSME throttling requirements 
and concerns were examined as a part of the SSME control system and 
Space Shuttle ascent performance. 
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The Controller design is basically completed with some redesign 
> . lort to alleviate problems as they have shown up during the develop- 
ment test program. While the hardware is proceeding through test 
the software programs are being developed that will both test and 
operate the SSME and interchange data with the Orbiter vehicle and 
Rround support equipment. The software to hardware compatibility 
focuses on the computer/memory capability in terms of words and time- 
to-process input and outputs as well as the expected programming 
errors and deviations. 

Controller design is well into the test phase. Development 
testing has been continuing using the structural thermal engineering 
model (SM-1). The production prototype controller (PP-1) has been 
undergoing a very thorough test process since early 1975 and is now 
leing used in the software development program. Production proto- 
ivpe-(PP-2) is now being used in the test program. The Integrated 
ijystem Test Bed program has been using flight type hardware and the 
k. >-l rack mounted controller for the numerous test firings conducted over 
more than ten months at the National Space Testing Laboratory (NSTL) . 
.<ince the Controller design is in the test and specific redesign period 
tUat comes after the basic design and assembly has been completed prob- 
lems are expected. Most of these have been acceptably resolved. 

A major challenge was to protect the Controller from the vibration 
caused by the total environment system. To screen the PP-2 controller 
from assembly and workmanship problems, it was subjected to the following 
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environment: X2 and axes at 2g sine sweep, 5 Hz to 2000 Hz up and down 

for 17 minutes; 6g random duration of three minutes; 2g sine sweep, 5Hz to 
2000 Hz up and down for seventeen minutes. At the same time SM”! was used 
to develop a vibration mounting for an environment beyond that of the PF’'2 
tests. FP-2 was then subjected to 25 hours of vibration testing with 
Isolators (Intended use) as follows: 22.5 hours (7.5 hr per axis) at 

22.5 g BMS, 2.5 hours of transient and sinusoidal vibration, and 120 starts. 
The overall results were good. Four anomalies were found and all were 
attributed to assembly /workmanship problems. The causes were determined and 
the unit was repaired. FP-2 has been delivered to the NASA MSEC Simulation 
Laboratory for continued testing and SSME operational support. The PP-3 unit 
with Isolators has been delivered and Is Installed on SSME engine 0002 and 
successfully operating on test stand A-2 at NSTL with 16 engine tests to date. 
The vibration test results for PP-3 are as follows: 

a. In a soft mounted condition the unit successfully passed 
30 minutes per axis of random vibration at 22. 5g RMS, 25 starts and 
cutoffs, and side^load simulations. 

b. In a hard mounted condition the unit successfully passed a 
10 minutes workmanship test in one axis at 4g RMS and 2g sine. 

c. An additional test of 9 minutes at 22.5g RMS was con- 
ducted successfully. 

The PP-1 controller was subjected to the following vibration 
conditions earlier in 1975: 

a. Thermal tests Included 8 hours of operation at -50° F. 
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and 48 hours of operation at +95° F. 

b. Vibration tests Included: 3.5 hours sine at 2g and 6g 

random for acceptance test program; 0.75 hour with 18 to 22. 5g ran- 
dom for diagnostic work; 1.5 hours of 22. 5g random for Development 
Verification Levels; and, 8.5 hours of 22. 5g random with isolators 

In place. 

c. Functional performance tests to evaluate the "pre" 

versus "post" test performance pre-thermal test and pre- 

vibration test followed then by post thermal and vibration tests. 

A number of small problems, as noted before, have been en- 
countered and resolved, such as memory noise, cracked solder joints, 
minor circuit design problems, problems with a number of jumpers and 
piggy-back components affecting circuit board reliability and some 
manufacturing difficulties. The problem of electromagnetic inter- 
ference (EMI) emanating from the power supply may not be fully re- 
solved as yet and will be followed by the Panel. 

Tne current major redesign effort has been directed toward the 
broken wire problem where so-called "stitch-welding” of wires to pins 
has been used. The connection would break under the vibration 
expected on the missions. This is a problem found on both the out- 
board Master Interconnect Board and the inboard Master Interconnect 
Board. 
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The redesign program put Into action in December 1975 was in 
two phases. The first phase completed in February 1976 de£ine< the 
problem and requirements to the satisfaction of Rocketdyne and MSEC. 

The second phase, if implemented , is to develop a board design that 
could eliminate the wiring/weld breakage which has occurred in test 
vibration environments. Such designs would be directed toward de- 
velopment of multilayer boards to eliminate the wires and hence the 
wire breakage. If they are used, the multilayer board design can 
be used on the P-4 and subsequent controllers. If necessary a retro- 
fit can be made on the pre-production units at a later date. 

Controller software includes the operational programs, command 
and data simulator executive program, and controller acceptance 
test program. The software for the ISTB (Integrated System Test Bed) 
engine has been in use since May 1975 at the NSTL. The next software 
to be released is for engine 0002. The Operational Program is sched- 
uled for May/ June 1976 and the Command and the Data Simulator Executive 
Program for March/Aprll 1976. Updates to the 0002 engine operational 
program is scheduled in two steps - the Block I update by the end 
of 1976 and a Block II update at an unspecified date. 

Software and hardware compatibility aspects of the SSME con- 
troller will continue to be studied in an effort to provide proper 
margins and process times. The current situation looks like this: 
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Memory Size Process Time 


SOFTWARE FOR 

(16,384 

UTILIZED 

words) 

BUDGET 

(20 milliseconds) 
UTILIZED BUDGET 

ISTB 

14,595 


17.36 ms 

- 

ENGINE 

15,270 

- 

18,4 

- 

BLOCK I (Pre Scrub) 

20,040 

14,000 

18.265 

16.0 ms 

BLOCK I (With Scrub) 

13,585 

14,000 

13.63 

16.0 

BLOCK II (Prel. Est.) 

14,700 

14,700 

15.18 

16.0 


Software scheduling problems include the availability of Honey- 
well personnel and facilities to support NSTL derations on simulation 
runs and software changes for the ISTB program, and an even more severe 
condition when two of the NSTL test stands are operating at the same 
time. The available support for the current multiple software program 
(ISTB changes into the 0002 software and those within the 0002 programs) 
is also a problem due to manpower and facility availability. The im- 
pact of this scheduling difficulties will be an area of continuing 
review by the Panel. 

3. 2. 2. 5 SSME Hardware Components 

A discussion of the design progress of the engine components and 
assemblies at this point in the program must focus on the development 
and acceptance test programs since the engine design is basically 
complete. What design work is still going on is more in the line of 
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redesign and upgrading of designs based on test results. Therefore 
these areas of design are covered in the next section on "Test Program 
and Plans" or in the section on "Manufacturing." 

3.2.3 Test Program Plans 

The engine development program consists of a Design Demonstration 
Phase and a Certification Phase. The design demonstration activity is 
scheduled to be completed by the SSME Critical Design Review (CDR) 
in September 1976. This CDR will cover the completed and released 
design, the basic engine concept and the tests to demonstrate their 
validity. The certification activity will then Include work neces- 
sary after CDR to successfully complete the Preliminary Flight Certi- 
fication scheduled for November 1978 and the Final Flight Certification 
scheduled for Spring 1980. 

Testing during the design development and demonstration phase 
Includes laboratory testing as well as subsystem and engine hot- firing 
testing. 

The laboratory testing is performed at all hardware levels to 
accelerate the verification process and to minimize hot-fire tests 
by detecting problems early at the fundamental part level. The test 
program includes basic mechanical tests to verify material properties, 
dynamic tests of turbopump bearings in the operating fluid at full 
operating speed, and simulation of engine operational checkouts and 
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maintenance. Since laboratory tests are extensive, they provide con- 
fidence In many areas: (1) mechanical, (2) vibration, (3) flow, 

(4) environmental, and (5) functional. 

Subsystem hot-flre testing Is concentrated on the verification 
of those requirements and assumptions for which the engine environ- 
ment Is not required. Included In this test program are the Ig- 
nition system, prebumer, turbopumps and combustion assembly. 

The third element In this test phase Is the hot-flre testing using 
the Integrated Subsystem Test Bed (ISTB) - an engine with a develop- 
ment nozzle and breadboard controller. The ISTB program objectives 
are: 

(a) Development of the engine control. system. 

(b) Extended-duration testing of the oxidizer and fuel 
turbopumps . 

(c) Hot-flre verification of the engine hot-gas manifold. 

(d) Verification of engine starts, shutdown, and throttling 
throughout the range from minimum power level (MPL) to rated power 
level (RPL). 

(e) Supplementary verification of preburner and turbo- 
pump requirements . 

The- ISTB with Its controller provides control system and transient 
performance verifications as a supplement to engine testing. Thus 


38 


there is a demonstration of basic system integrity prior to the first 
engine test. 

Following the ISTB tests, hot-firing tests are scheduled at NSTL 
to (1) test equipment, and (2) to extend the power level to full 
power level (FPL). Equipment to be included in these tests are glm- 
bal actuators, inlet ducting, and interface panels for fluid, 
electrical, and thermal protection. Testing at sea level conditions 
will range from RPL to FPL. A test stand nozzle diffuser at NSTL 
allows operation of the engine between MPL and RPL. 

An integral element of any test program plan, including that for 
the SSME, is the series of Design Verification Specifications (DVS) 
because these define the development plan for the engine system, 
subsystems and components. Table 3-3 lists all of the current DVS's. 
Section 3 of these documents contains the design requirements while 
Section 4 contains the verification methods, hardware levels, and 
other criteria necessary to demonstrate that each design requirement 
has been satisfactorily met. In addition to the DVS's development 
plans there are special plans for "life demonstration" tests to 
ensure that a conservative margin is maintained and plans for "hard- 
ware recycling” in which test components and assemblies are made up 
of "new" and "recycled" units. Also, there are materials evaluation 
plans for the selection, development, and specification of all materials 
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and processes for the SSME. 


3.213.1 Test Status and Results 

The ISTB has been in a hot-firing condition since May 1975 at 
NSTL on test stand A-1. Engine 0002 has begun hot-firing at stand 
A-2. Engine 0003 when ready will take over the A-1 stand In mld- 
sunaer of this year. All of these tests, on the ISTB and 0002, 
are expected to be nearly complete by the time of the SSME CDR in 
September 1976. 

3. 2.3. 1.1 ISTB 

Well over 60 tests have been conducted to date. The next 
significant milestone is the achievement of a sustained 60-second 
engine firing at rated power level. This test has been delayed 
somewhat because of the time required for the resolution of engine 
transient and high pressure fuel turbopump development problems as 
well as a flow-meter problem on an Installation at the COCA stands 
at Santa Suzanna, California. As soon as these are resolved the 
60-second test will be accomplished. Another milestone will be the 
throttling test to be conducted in the midsummer with 
the power level from MPL to RPL. Further throttling tests are also 
scheduled for the period starting about August 1976. 

So far the ISTB has been run at 76X of RPL for more than 20 seconds. 
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Some of the problems that have surfaced have been resolved or are 
under Intensive study. Include the following: 

a. The main fuel valve assembly follower bearing side- 
plate cracked during theiSTB tests. Cracks were found on the Inner 
race section of the plate. The original 440C material was replaced 
with Inco 718 as an Interim redesign. If necessary the redesign will 
be refined at a later date. 

b. Electrical "pig- tails" are subject to environmental 
abuse and failures so a new connector design will be effective on engine 
2004 and subsequent. 

c. Prebumer, LOX and fuel, temperature spikes were a 
problem during the conduct of the first 29 ISTB tests. Modifications 
have been made and proven on subsequent tests. 

d. The low pressure fuel turbopump inlet/outlet duct con- 
sisting of a flexible bellows joint has had leak problems. Rocket- 
dyne is Investigating a number of fixes. For the present they have 
decided to Incorporate a brazed design bellows on engine 0003 and 
subs, while continuing to use the existing ducts on the first two 
engines (ISTB— 0001 , 0002). Indications are that the early-type 
flex ducts can withstand the rigor of continued firing in order to 
meet test requirements. 
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3. 2. 3. 1.2 Engine 0002 


This engine hnn just begun Its test cycle at NSTL with 16 tests 
conducted to date. Early testing has evaluated the start characteristics, 
while the most recent testing has evaluated fixes to the high pressure 
fuel turbopump. 

3. 2. 3. 1.3 Component Tests 

For our purposes the components of the SSME include combustion 
devices, turbomachinery and the controller. Previous sections have 
discussed the controller. 

From a standpoint of the critical hardware for the 0003 and 0004 
engines, the following problems exist. On the 0003 the bellows 
assemblies mentioned above have been brought ’’in-house" due to vendor 
problems which in turn has resulted in some changes to the 
schedule completion dates. However, there appears to be little or 
no impact from this delay since there is a pad of some six weeks avail- 
able. Engine component problems on the 0004 include the high pressure 
fuel turbopump, the main combustion chamber, and the 77.5:1 nozzle. 

This engine is due for delivery around September 1976. To help 
mitigate these problems Rocketdyne has completely revamped its so- 
called "pump assembly room" at Canoga Park to do a more orderly and 
timely job on turbomachinery. 

3. 2. 3. 1.3.1 Combustion Devices 

A testing sumnary is shown in Table 3-3 covering the following 


42 


items : 


Augmented Spark Igniter (ASI) Oxygen Preburner (OPfi) 

and Fuel Preburner (FPB) 

'nirust Chamber Assembly (TCA) Heat Exchanger 

Nozzle with 35:1 Ratio 

The 40,000 pound thrust scale model was used for tests at MSFG. 

In summary, the combustion devices test program indicates that 
the above items have been operating satisfactorily. Problems that 
have cropped up during the test program have either been resolved 
to the satisfaction of the designers or a resolution is now in 
process. For instance, the 35:1 nozzle TCA tests conducted at COCA 
4B show an excessive pressure drop existing between the inlet dif- 
fuser of the main combustion chamber, the tubes, and the mixer at 
the outlet. The measured pressure drop was 544 psi while the predicted 
was 349 psi resulting in an excess of 195 psi. These measurements 
were at RFL. The Impact on engine balance results in tube life de- 
crease and engine temperature Increases. This problem is under active 
investigation at this time with results expected soon. 

The Augmented Spark Igniter (ASI) has experienced spark plug tip 
overheating resulting in erosion and cracking of the plug tip. This 
problem is being worked by developing a copper-plating process, con- 
trolling the ISTB hydrogen temperature on engine start, eliminating 
temperature spikes during any transient and using the copper-plated 
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plugs on the engines when they become available. 

Steps taken to prevent other combustion device fabrication prob- 
lems Include prevention of pitting In the main combustion chamber 
liner by revising tooling for the electroform process and prevention 
of the 77.5:1 nozzle braze and weld problems by redesign of the mani- 
fold shell and modified tooling for brazing process. 


3. 2. 3. 1.3. 2 Turbomachinery 

The significant results of the 

Low pressure oxygen turbopump 

Low pressure and high pressure 
oxygen turbopump 

Low pressure fuel turbopump 


Low pressure and high pressure 
fuel turbopump 


High pressure oxygen turbopump 
Seals and Bearings 


turbomachinery tests are: 

Tested to Pull Power Level 

Tested to RPL (Transition) 

Tested to 0.92 of RPL (Steady-State) 
Impeller performance defined 

Tested to FPL 
Performance Mapped 
Bearing failure experienced 

7 tests, tested to 0.75 of MPL 
Axial thrust balance difficulties 
resolved; speed limitation on HPFTP 
because of subsynchronous whirl 

Borg-Wamer wear problem investigated 
Testing Initiated on "Sealol" Seal 


The problems noted can be described as follows: 


(a) The LPOTP housing had failures during the RPL proof 
test. Inspection of the casting is a difficult task. As a result, 
the problem is being approached from both a materials aspect as well 
as providing a more thorough inspection process. 

(b) The HPOTP impeller performance has been lower than 
expected at the RPL condition. This appears to have resulted from 
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impeller vane resonance and resulting lowered outlet head. Modifi- 
cations of the impeller are being made and further testing will con- 
firm the redesign. 

(c) The HPFTP rotor axial thrust balance problem has been 
the cause of axial rubbing and damage during tests of this pump. 

The problem is recognized and understood. A step-by-step procedure 
has been followed to balance the rotor system such that during running 
conditions the system will be balanced by means of internal orifices and 
preclude overspeeding and rubbing of parts. The rotor system has been 
balanced in tests up to 75% of RPL. Additional tests up to full power 
level must now be conducted to confirm the design. 

(d) The high pressure fuel turbopump sub synchronous whirl problem 
has been the cause of excess shaft vibration and turbine bearing load 
failures. A step by step procedure is being followed to reduce the 
vibration level so that long duration engine tests can be conducted 
above the 60% RPL. Moderate improvement from immediate fixes has raised 
the whirl inception speed and reduced the severity of the vibrations. 
However, to completely resolve the problem and enable the pump to run 
up to full power level, a stiffened rotor and support system plus moving 
the pump and bearing inboard will most likely be required. 
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(e) The HPOTP primary LOX seal has had InvUdequate life 
due to excessive wear. There Is no Immediate problem on the engine 
test stands; however, steps are being taken to reduce the load on 
the seal and provide a better seal material in the future. 

3.2.4 Manufacturing 

Since manufacturing is discussed In varying degrees in the pre- 
ceedlng sections on review, design and test of the SSME and its com- 
ponents, the discussion here is limited to four items that are of 
major interest at this time: (1) the increase in the turbopump 

assembly area and facilities at Rocketdyne, (2) machine tool require- 
ments and rehabilitation program, (3) welding, and (4) pre-production 
in-house fabrication maturity. The turbopun^ assembly operation is 
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being expanded so that It can handle eight assemblies simultaneously. 

This requires increased supervision, mechanics, and quality concrol; 
duplicate tooling; three-shift operations in most cases; and, a 
setting up of a standardized assembly or flow process to optimize 
the use of men and equipment. The machine tool study is also a step 
in making the very best use of on-hand equipment. Welding has been a 
consistent problem on the more complex configurations used in the 
main combustion components and some turbopumps as well as the full- 
size 77.5:1 exit nozzle. Quality of the welding is being improved 
by a program to use automatic welds rather than manual welds and 
upgrade the machines themselves. The following is a list of weld changes 
from manual to automatic in the course of the period between October 


1975 and February 1976: 

10/9/75 1/15/76 

Ducts 66 15 

Turbopumps 7 0 

Main Combustion Chamber 3 0 

77.5:1 Nozzle 1 2 

Hot Gas Manifold 3 2 


It is understood that the first "good" 77.5:1 nozzle has completed 
its fabrication cycle with minimum weld distortion which indicates 
that particular problem may be resolved. 
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3,3 Addendum 


ISTB testing with the reworked Low Pressure Fuel Turbopump was restarted 
at the end of May and testing at the COCA IB facility has been resumed 
as well. 

Accelerations, vibrations and unbalanced forces on the rotating shaft 
and blades of the High Pressure Fuel Turbopump have caused premature 
engine shutdown a number of times. This appears to be the result of 
subsynchronous whirl effects or pressure oscillations 
at frequencies near 50 to 55% of the actual pump speed itself. To 
resolve this problem, outside specialists have been consulted; a 
literature search of hundreds of publications and speciality texts from 
several nations has also been started. The most promising fixes appear 
to be increased Coulomb damping on the bearing carrier; a tangentially 
vented pressure relief interstage seal; reduced interstage seal length; 
reduction in shaft hysteresis; decoupled axial and radial modes; 
and, of course, any combination of the above modes. 

The SSME System Safety activities currently underway includes an 
update of the SSME hazard summary listing all identified hazards and 
erases; preparation of the final report on the NSTL hazard analysis 
for the A-1 and A-2 test stands; and the planning of an oxygen fire 
symposium to assure test personnel are up to date on the current 
safety provisions. 

The P-4 engine controller assembly is on schedule. Power supplies 
for this unit have successfully passed a 10 minute, three axis subsystem 
vibration test- The P-4 controller is due at Rocketdyne in September 1976. 


48 


ATTACHMENT 3-1 


The major challenges of significance for crow safety on the 
Spree Shuttle Main Engine are materials behavior under severe 
environments, weld integrity, POGO suppression, and engine 
controller performance and reliability. Therefore, the results 
of the tost program will be critical to developing confidence 
in those areas. 

SSMB Materials Behavior Under Severe Environments 

(a) An extensive analysis and test program is we3 1 underway. The 
fracture mechanics tost program has been expanded to include more 
materials and components. Fracture mechanics analyses inclvide 
load cycling and environmental conditions, nl loy/^-ondition combina- 
tions, weld combinations, and the effects of coalings and weid 
overlays. These analyses will bo verified by the tost procjram. 
Minimum detectable flaw sizes will be ostablishod by non-dc‘structi.vc 
methods. In addition, an assessment of the structural margins in 
the SSME with regal'd to structural, wei<iht, and performance re- 
quirements was conducted by a high level team composed of members 
from JSC and MSEC. All 117 components reviewed meet the engine 
safety factor requirement of 1*.4 at full power level, and 88 of 
these meet a 1.5 safety factor at full newer level. 

SSME W o ld Integrity 

(b) Fabrication of the first engine and supporting components 
revealed areas requiring improvements in weld integrity. Exten- 
sive action has been taken in the area of weld analysis, redesign 
of some weld joints, converting from manual to automatic v/elding, 
evaluating of process parameters, upgrading/increasing staff, up- 
grading equipment and improvements in inspection and quality control 
procedures to assure good welds. 

POGO Suppression 

(c) A continuing analytical program is underway and being pursued 
to understand the POGO phenomenon and its implications to the SSME 
by NASA field centers and their contractors. A POGO integration 
panel, chaired by Dr. Harold Doiron of JSC, has been in operation 
since June 1973, to continually review analytical and test data. 

The POGO suppressor has been baselined and a comprehensive test 
program on individual component parts is already underway. Engine 
tests will verify the POGO suppressor system. Extensive use has 
been made of Saturn data in designing the test program. 

Engine Controller Performance & Reliability 

(d) High priority by top management at Honeywell, Rocketdyne, 

MSFC, and Headquarters is being applied in this area. Because of 
current problems with the controller interconnect system (inboard 
master interconnect system) and the fact that it is difficult to 


49 


ATTACHMENT 3-1 (Continued) 


nmnufcicturc and teproduco, two studies have been initiated on an 
interconnect redesign effort as a product improvement. Further- 
more, we are proceeding to mount the controller on isolators (shock 
mounts) which significantly reduce all vibration energy into the 
controller at frequencies above 100 Hertz. In addition, RTV potting 
and foam have been added to the inboard master interconnect board 
to reduce wire stress concentration and dampen the wires dynamics. 

It should be noted that the. wire breakage problem we have encountered 
has been associated with the inboard half of the controller inter- 
connect system, and not the memory plated wire. 


attachment 3-2 


Allowable SSME Ilcat ExchanRor Oxiclizor 
Coil Leakage Rato 


We are glad that they arc keeping an open mind r)n this ainco a leak vale 
of 10 cc/sec helium during field operational leak test inspection souiifls 
like a fairly large crack. This is a critical piece of gear. Is this a 
case where the l60 hour turnaround time is the driver? 


Answer: 

The heat exchanger leakage rate test requirement for launch operations 
has not been firmly established. The 1 x 10"^ cc/sec helium check is 
being used for planning purposes. The necessary leak check and/or any 
other inspection requirement will be based on the development experience 
and the assessed risk of a failure. The l60 hour turnaround req\uromenl 
will no doubt be a consideration in all ground operation planning but will 
not be the deciding factor. 
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ATTACHMENT 3-2 (Continued) 


Use of Teflon Balls in POGO Suppressor Unit 


What are the requirements for the ground tests to verify this design? 
How closely can they approximate flight conditions? 


Answer: 


The hollow teflon balls utilized in the POGO suppressor will 15C suljjected 
to extensive testing as individual parts as well as in component tests. 
They will also be utilized and subjected to operating conditions diiring 
all engine testing subsequent to incorporation of the suppressor into the 
R&D program. Being an internal part of the engine system, the teflon 
balls should be subjected to operating conditions which closely simulate 
flight conditions. The only known difference will be operation in a 1 -g 
environment as opposed to a flight environment of up to 3-g's. It is not 
anticipated that this difference will have an effect oh the operation of 
the balls. 
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ATTACHMENT 3- 2 (Continued) 


Delays in Receiving and Testing SSME Components 

What is the nature of these problems? What is the impact on the NSTJj 
test program? 

Answer; 


The SSME Project is experiencing delays in the nianufacturc of hardware 
similar to that experienced on previous engine development programs. 
The delays are indicative of the complexity of the various manufacturing 
processes involved and the development learning cycle. However, at 
this time approximately three specimens have iu'cn made of all hardware 
items, except for the 77:1 nozzle, scheduled for ompletion in early 
CY76. The initial specimen experience a.nd the hardening of the tooling 
continually improves the hardware schedule visibility. The testing of 
components and the engine system is not being driven by the hardware 
schedules and adequate hardware exists to perform the tests as the 
test facilities and engineering planning allow. 
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ATTACHMENT 


3-2 


(Continued) 


SSMEJ Controller 


When do you expect to have the necessary information on the problems 
with the current Controller to make a decision on the backup unit? 

What kinds of information will be considered? 


Answer: 


The test experience with the first prototype controller (PP-1) and the 
ISTB experience with the rack mounted controller (EM-l) and its 
software, have eliminated the need for further backup controller 
planning. While some changes are being considered to reduce sense 
line noise and to reduce fabrication problems with the Master Inter- 
connect Board (MIB), considerable experience has been accumulated 
through functional and environmental tests of PP-1 and through the 
ISTB tests conducted to date at NSTL. While long duration testing at 
environmental extremes is still to be completed over the next few 
months, the functional and short test duration thermal and vibration 
data accumulated to date indicates that the present controller can 
be made to function within the engine program constraints. Closure 
of the backup controller contingency planning effort is presently being 
staffed between Level II and Level 1. 

(The November 1974 Contingency Plan for SSME Controller identified 
a target date of early July 197 5 for making a decision on this svibject 
based on projected availability of testing experience and ])rocur emenl 
lead times. At the time of our review with the Panel, late April, llu' 
test and manufacturing experience accumulated with Pl^-l indicated that 
backup controller effort would not be required. ) 
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TABLE 3-1 


FACrr-- 3 OF SAFETY FOR SSME 

AT FULL POWER LEVEL VS . RATED POWER LEVEL 

Factor Of Safety (CalcuL' i:ed) 
SSME HARDWARE ITEM FPL RPL 


Low Pressure Oxidizer Turbopump 


Housing 

1.50 

1.67 

Inducer 

1.50 

1.67 

Turbine Blades 

4.40 

4.90 

Turbine Stator Vanes 

1.42 

1.58 

Shaft 

1.69 

1.69 

Low Pressure Fuel Turbopump 

Turbine Housing 

2.12 

2.29 

Pump Housing 

1.53 

1.64 

Inducer 

2.74 

2.90 

Shaft 

1.91 

2.02 

High Pressure Oxidizer Turbopump 

Second Stage Turbine Blades 

1.76 

2.03 

First stage Turbine Disc 

1.48 

1.71 

First stage Turbine Nozzle 

2.27 

2.50 

Turbine bellows 

1.69 

1.97 

Turbine Fairing 

2.28 

2.67 

Turbine Exhaust Struts 

1.50 

1.75 

Turbine Inlet Housing 

1.65 

1.93 

Pump Housing- Inlet 

1.62 

1.89 

Discharge 

1.62 

1.70 

Diffuser Vanes 

1.41 

1.50 

Preburner Volute 

1.59 

1.70 

Main Shaft 

1.50 

1.75 

High Pressure Fuel Turbopump 

Second Stage Turbine Blades 

1.40 

1.49 

Second Stage Turbine Disks 

1.40 

1.49 

First Stage Turbine Nozzle 

1.83 

1.96 

Second Stage Turbine Nozzle 

1.55 

1.66 

Turbine Bellows 

1.53 

1.64 

Turbine Bearing Thermal Shield 1.76 

1.89 

Turbine Bearing Support 

2.66 

2.86 

Shaft System 

1.46 

1.53 

Pump Housing-Mount' g flange 

1.50 

1.61 

Discharge 

1.82 

1.94 

Diffuser Vanes 

2.12 

2.26 

Pump Inlet vanes 

2.00 

2.20 

Third Stage Impeller 

1.79 

1.91 

First Stage Diffusers 

1,50 

1.61 
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TABLE 3-1 (continued) 



FPL 

RPL 

Valve Actuators 

Connection Flange 

1,40 

1.40 

Pressure Cylinders 

2.00 

2.00 

Glmbal Bearing 

Body 

1.48 

1.57 

Shaft 

1.64 

1.64 

Seat 

1.47 

1.47 

Hot Gas Manifold 

Shell 

1.42 

1.56 

Injector Weld 

2.08 

2.29 

Fuel Preburner Weld 

1.55 

1.70 

Oxidizer Preburner Weld 

1.45 

1.59 

Fuel-Side Collector Liner 

9.- 

9.- 

Fuel-Side Transfer Tube Liners 1.75 

1.75 

Oxid-Slde Collector Liner 

2.90 

2.90 

Oxid-Side Trans. Tube Liners 

4.22 

4.22 

Heat Exchanger Weld 

2.70 

3.00 

Main Combustion Chamber 

Actuator Struts 

1.41 

1.41 

Inlet Manifold 

1.41 

1.48 

Discharge Manifold 

1.47 

1.55 

Longitudinal Welds 

1.40 

1.50 

Liner- Electro Deposit Ni 

1.60 

1.79 

- Narloy-Z 

2.29 

2.54 

Acoustic Cavity 

2.61 

2.83 



REDUNDANCY MANAGEMENT DEFINITION 




TABLE 3-3 


DESIGN VERIFICATION SPECIFICATIONS 
(DVS) 

Specification Title Specification Number 

Engine System 

Main Engine (Vols. 1,2) SSME #101 

Gimbal Bearing Assembly 102 

POGO Suppression System 106 

Avionics 

Controller Assembly (Hardware Vol. 1, Software Vol. 2) 201 

Electrical Harness 202 

Instrumentation System 203 

Flowmeters 204 

Ignition System 205 

Combustion Devices 

Thrust Chamber Assembly 303 

Hot-Gas Manifold 304 

Fuel and Oxidizer Preburner Assemblies 305 

Turbomachinery 

Low Pressure Oxidizer Turbopump Assembly 401 

Low Pressure Fuel Turbopump Assembly 402 

High Pressure Oxidizer Turbopump Assembly 403 

High Pressure Fuel Turbopump Assembly 404 

Valves and Interconnects 

Check Valves 508 

Pneumatic Control Assembly 510 

Flexible and Hard Duct and Line Assemblies 511 

Hydraulic Actuation System 512 

Heat Exchanger 513 

Static Seals 514 

Propellant Valves 515 

Fuel and Oxidizer Bleed Valve Assemblies 516 

POGO Suppression System Valve Assemblies 517 
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4.0 ORBITER THERMAL PROTECTION SUBSYSTEM 


4.1 Introduction 

The Orbiter 101 Critical Design Review and the Orbiter 102 Preliminary 
Design Reviews have resulted in a reasonably firm baseline of the 
Orbiter Thermal Protection Subsystem (TPS). As a result, detailed 
drawing releases, fabrication of hardware, detailed tests, have all 
begun. Hie Panel reviewed both the management systems and their 
implementation as well as the technical adequacy of the TPS. Given 
this new technology, the Panel wants to assure an adequate basis of 
confidence in reliability of the TPS and therefore crew safety. 

Hie panel has had this critical Shuttle hardware system under 
review during the past two years as shown in Table 4.1. The Orbiter 
TPS is, of course, a many-faceted system of the Orbiter. It is affected 
by many factors: aerodynamic pressures; structural deflections on the 

Orbiter; and the External Tank and Solid Rocket Booster elements of 
the Shuttle Cluster. Given this complexity it was apparent that the 
Panel could not provide detailed scrutiny of all these aspects. There- 
fore the Panel and the Task Team focused on (a) the technical require- 
ments for the TPS during phases of the Shuttle mission, (b) those 
features of the TPS most affected by unique mission requirements, 
operational restrictions, resource reductions, (c) challenges created 
in using new technology, and (d) flight test requirements not pre- 
viously experienced on manned space flights. 
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The Panel examined the management systems in terms of its a- 
hcrant capability for handling (a) communications between technical 
personnel and through senior levels of management, (b) the hazards 
identified and their resolution and risk assessment, (c) such major 
technical problems and interface effects as design, test, fabrication, 
logistics, maintenance, and assembly. Technical areas covered in 
these discussions covered materials and processes, thermal analyses, 
structural adequacy, systems integration, TPS and Orblter hardware 
properties affected by aerothermod3mamics of ascent and reentry. 

Many parts of the program impacting the TPS are under review by 
the Task Teams for such areas as the Shuttle Major Ground Test Pro- 
gram, Approach and Landing Test Program, the Orbital Flight Test 
Program, Development Flight Instrumentation, External Tank and Solid 
Rocket Booster Programs, and Risk Assessment. 

The fact-finding began with detailed preliminary data collection 
and analysis resulting in a discussion with appropriate program 
personnel to establish the specific areas of interest, the personnel 
that should be involved and the best sites for the discussions. Then 
the team undertook on-site reviews with various levels of working and 
management personnel and examined as appropriate the hardware/software, 
tests, and documentation. 

The team then reviewed the program response to their action item 
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and subsequent baseline reviews and test results. This report Is 
based on such activities. 

4.2 Observations 

4.2.1 Organization 

There have been no measureable changes In the management organ- 
ization of personnel since the Panel's last report to the Administrator 
dated June 1975. Based on discussions with NASA and contractor per- 
sonnel the organization appears to be operating well and is producing 
the necessary communication between all levels. Top management has 
visibility of the overall status of the TPS program. The Panel vrill 
continue to review the ability of the various TPS organizational 
elements to respond quickly. to changing program needs when they are 
defined at the Orbiter 102 Critical Design Review and as a result of 
the updated "loads programs." 

4.2.2 Review System 

The Orbiter Thermal Protection Subsystem Design Review conducted 
from mid- July through mid-August 1975 was an extension of the Orbiter 
102 Preliminary Design Review (PDR). Since this is a good example 
of the depth and scope of such a review, the following particulars 
on the process are cited: 

July 28th Data Packages after having been 

checked and assembled were sent to 
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participants for critique at the 
following locations: JSC, KSC, ARC, 

LaRC, NASA Headquarters, SAMSO. 

July 28 - August 8 The data was reviewed and Review 

Item Dispositions (RID’ s) were sub- 
mitted as a result of this critique. 

The Screening Group reviewed all RID’ s , 
resolved the technical or management 
questions where appropriate and identi- 
fied those items to be brought before 
the full, formal Review Board, 

The TPS Formal Review Board reviewed 
the actions of the screening group, 
resolved the issues which required 
their management authority and assigned 
the actions to be taken in ensuing months. 

The distribution of RID’s across the TPS technical areas is indicative 

of where the remaining challenges were found; 

Structures (reuseable Carbon-Carbon leading edge, reuse- 

Surface Insulation-Tiles and Nomex, Thermal Con- 
trol Subsystem- Internal, Stress/Loads, Materials /Pro- 
cesses) 83 

Development Flight Instrumentation and Avionics lA 

Aero Sciences 

Systems Integration 

Test Program 

Reliability/Safety 

Quality Assurance 

Manufacturing 

The risk management system for the Orbiter TPS was also reviewed. 


27 

_i. 

22 

2 

4 

4 


August 12-13 


August 14 
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Uie system is continuing to produce hazard assessments. For example, 
the NASA document "Space Shuttle Safety Coi.v« .% Summary Report," JSC 
09990, dated December 15, 1975 covers the following: 

a. Damage to the Orbiter TPS from the ice shed from the 
External Tank. 

b. Possible impact of the External Tank and Orbiter after 
initial separation. 

c. Damage to the Orbiter by the motor plume from Solid 
Rocket Booster after separation. 

Based on the material presented to the Panel and the discussions 
between Panel members and NASA and contractor personnel it appears 
that the review system as applied to the Orbiter TPS is working 
reasonably well at all levels. 

4.2.3 Documentation 

The Panel selectively reviews TPS related documents covering 
the various aspects of the design, test, and fabrication of the 
Orbiter TPS. Table 4-2 is a partial listing of the documentation 
reviewed by the Panel since its last report to the Administrator. 

4.2.4 Design Progress 

Since the basic Orbiter TPS has been described in both prior 
Panel documents and many NASA and contractor program documents, it 
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is assumed that the reader is acquainted with the TPS subsyste or 
has access to the material noted above. Observations as presented 
here cover several areas: (a) significant changes to data reported 

in the Panel's last Annual Report to the Administrator, (b) new in- 
formation developed during Panel reviews and task team activities, 
and (c) observations of other Panel Task Teams that relate to the 
developing basis of confidence in the Ovbiter TPS' ability to support 
a successful Orbital mission. 

4. 2.4.1 Mass Properties 

The new Felt Reuseable Surface Insulation (FRSI) replaces a por- 
tion of the low temperature tiles (LRSI). This change reduces the 
TPS accountable weight by some 300 pounds. A description of this 
newest addition to the TPS is provided in Paragraph 4 . 2.4.3. However, 
there are a number of items that are expected to lead to weight increases. 
These items Include definition of the penetrations and closeout, beef- 
up of the reinforced carbon-carbon panel, the outer moldline fairing, 
the high pressure gradient flow barrier, the aero-surface seal require- 
ments, LRSI coating thickness and optical property change. 

4. 2. 4. 2 TPS Material Distribution 

The distribution and configuration of the five (5) different 
types of TPS materials used to cover the Orbiter surface are as 
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shown in Figure 4-1. 


4. 2.4. 3 Felt Reuseable Surface Insulation (FRSI) 

Studies conducted in the last months of 1974 showed that the 
minimum gage LRSI tiles overprotected the structure in many areas. 

The temperature of the structure in these areas was below 350° F. 
so that it might be possible to have a "bare top surface." This 
was, however, considered an unacceptable risk for the first orbital 
flight. The concentrated test and analysis program covered many 
materials and material systems and finally selected the Nomex felt. 
Therefore, the LB5I tiles covering areas with surface temperatures 
of £ 700° F during entry and at 750°F or less during ascent have been re- 
placed with DC92-007 silicon paint coating on Nomex felt. There is a con- 
tinuing effort to extend the use of this coated Nomex material to 
further reduce weight and complexity of the TPS. The only major con- 
cern in changing from tile to Nomex was that there might be a "flutter" 
interaction. Therefore, a two-foot by four-foot specimen is presently 
being tested at the Ames Research Center to determine the "flutter" 
characteristics of this assembly. Table 4-4 describes the FRSI material, 

4. 2.4.4 Orbiter 101 

There is a concern regarding the simulated tiles on the Orbiter 
101 for the Approach and Landing Test program vehicle. These are 
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made of polyurethane foam covered with Hypalon coating. The c< ncern 
is with the foam material and its compatibility with various Orbiter 
fluids, e.g., hydraulic fluid, APU propellants, etc. There is a 
potential fire hazard due to this incompatibility. NASA and the 
Orbiter contractor are examining this area and expect to have a 
resolution available shortly. 

4. 2. 4. 5 TPS Issues 

At the time of the Panel's review the following technical chal- 
lenges were being worked so each is discussed in the following para- 
graphs ; 

a. HRSI and LRSI tile coatings. 

b. Unique shaped tile 

c. Tile-to-tile steps 

d. Airframe panel buckling 

e. Static door thermal barriers 

f. High pressure gradient barriers 

g. Use of densified fused silica 

h. Use of minimum thickness LRSI tile 

i. Body flap, rudder speed brake, elevon aerothermal seals 

4. 2.4. 3.1 Tile Coatings and Unique Shaped Tiles 

There is an intensive and detailed materials development program 
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for the tile coating. The program has been conducted by NASA at the 
Ames Research Center, Johnson Space Center, Rockwell Internationa)., 
and the Lockheed Missile and Space Company. In trying to meet the 
RSI tile coating goals, the program has been having problems with 
cracks In the coating on the sidewalls of the High Temperature Re- 
useable Surface Insulation. The Low Temperature tiles (LRSI) coating 
is still undergoing demonstration tests on the mechanical adequacy 
and characterization of its material properties. 

The goals for the RSI coating are to: 

a. Minimize devitrification during thermal exposure. 

-7 

b. Minimize thermal expansion coefficient (about 3 x 10 
in./in./°F) . 

c. Minimize morphological (form and structure) changes 
during thei^al exposure. 

d. Maintain imperviousness to water. 

e. Optimize optical properties^ £^0.8, HRSIg^l.O, LRSI^^O.4 

f. Meet dimensional tolerance requirements. 

g. Provide as much as possible resistance to ground handling 
and impact damage. 

Based on the latest information available to the Panel the pro- 
gram has an approach to resolving the tile coating problem. The pre- 
sent coating (identified as #0050) consists of silicon carbide and 
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cobalt oxide emissivity agents. The basecoat is slip cast fuseJ silica 
with a basic borosilicate glass as the coating. The teat program to 
resolve the #0050 coating problems involves Lockheed, Rockwell, Ames 
and JSC support during the first portion of 1976. At the same time 
there is a program to evaluate the reaction cured glass coating pro- 
cess developed by Ames Research Center. The so-called reaction cured 
glass coatings are produced by blending the components, then affixing 
them by spray or paint on the substrate and finally heating the coated 
tile rapidly to the reaction temperature for the reciprocal action of 
the ingredients on each other. The result is a three-layered coating 
with an outer layer of Boron Oxide rich glass, a center layer of Boro- 
silicate glass + Tetraboron Silicide, and an inner layer against the 
tile of borosilicate glass. When the tests and analyses are com- 
pleted it is expected that a final decision on the coating material 
will be made in mid- 197 6. 

In addition to the effort to produce un-flawed coatings, Rockwell 
International is evaluating the impact of flaws on mission performance. 
This seems worthwhile since the coating cracking problem appears to 
be applicable to the LRSI as well as the HRSI; the tiles are subject 
to damage by any impact, human or natural; and there is presently no 
viable test method of detecting the sidewall flaws. 

For the total TPS tile program, NASA approved material character- 
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Izatlon plan specifies that: 


"The mechanical properties, as described under test 
programs are divided into three categories to prevent 
unnecessary and redundant testing. 

Category 1: The approach is to test enough specimens 

in one or more critical properties to verify gaussian 
distribution in a population of specimens taken from 
multiple batches of material that has not been well 
characterized previously. Where similar materials 
have been well characterized or where generous mar- 
gins are predicted, fewer test specimens are re- 
quired. A demonstration of a 1.5 safety margin, us- 
ing material properties degraded by 100 mission thermal 
history, will satisfy any requirements for further 
testing of that property. 

Category 2: With only a minimum number of data points 

scheduled in Category 1, some unsatisfactory margins 
may result. In these cases. Category 1 results will 
be assessed, and additional testing will be performed. 
In addition, certain tests will be conducted when in- 
formation is required but does not result in a design 
allowable. Category 2 tests cannot be completely de- 
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fined until Category 1 testing is complete. 

Category 3; After satisfactory allowables are generated, 
other conditions that could affect the useful life of 
the TPS will be evaluated. These are not yet completely 
defined but include evaluation of the effect of natural 
environments, working fluids, temperature overshoot, 
permeability, and waterproofness." 

Only Category 1 tests are defined in the current issue of the 
test document RI SD74-SH-0156. 

4. 2.4. 5. 2 Tile-To-Tile Steps 

To assure an undisturbed airflow over the Or biter tile surfaces 
the program must assure that the height of adjacent tiles be held 
within very tight limits. Figure 4-2 shows the 10-mil "forward step" 
criteria which is an installation problem covering about 17% of the 
TPS area. Other areas may permit a somewhat greater step difference 
as shown, i.e., 30-mil forward and 50-mil backward steps in non-critical 
aero thermo -dynamic areas. 

4. 2.4. 5. 3 Airframe Panel Buckling 

The problem with possible cracking of thin tiles as a result of 
structural deflections was noted in the Panel's last annual report. 
Currently this could be a problem in some 1800 square feet 
of surface compared to an original estimate of a little more 
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200 square feet. Therefore, it is an issue which continues to re- 
ceive attention. The program is considering such proposed solutions 
as use of softer strain isolator pad (SIP), smaller tiles, strength- 
ening of the structure, and the reduction in thin tile area by using 
Nomex (FRSI). Trade-off studies indicate at this time that the most 
cost-effective solution is to revise the structure rather than modify 
the TPS with the exception of using FRSI. 

4,.2.4.5.4 High Pressure Gradient Barriers 

There are a number of locations, comprising fairly large surface 
areas, where there are high to low pressure gradients along the tile 
gaps resulting in increased gap heating and possibly flow- tripping. 
Such regions where such connections between high and low pressure 
flow can exist include chines and trailing edges in particular. The 
problem is to preclude the flow of gas through the gaps with barriers 
of some type. The manner in which these flow stoppers could be manu- 
factured and installed are still under study. 

4. 2.4. 5. 5. U se of Minimum Thickness RSI Tile 

This area of concern has been discussed in the previous sections 
on the possibility of replacing very thin tiles with Nomex Felt; the 
effect of flutter and structural deflections; and hot gas flow due 
to high pressure gradients. Thin tiles have a thickness not exceeding 
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about 0.3 inch. They cover some 2000 to 3000 square feet of Orbiter 

surface and are susceptible to breakage during handling and launch 

preparations. Their distribution is as follows: 

2 

Straight flat tiles 1000 ft (approx.) 

2 

Single curvature tiles 500 ft (approx.) 

2 

Double curvature tiles 1000 ft (approx.) 

The straight flat tile obviously represent the least problem and 
can most likely be accommodated by simple methods. However, the single 
curvature tiles have not demonstrated that they have sufficient strength 
to be handled in a manner like the flat tiles. Even less is known 
about the handling qualities and requirements for the double curvature 
tiles. In any case, it i.> necessary to demonstrate the techniques 
that can adequately handle these tiles without undue damage. 

4. 2.4. 5. 6 Use of Densified RSI and Thermal Barriers for Doors 

Densified RSI is a silicon carbide impregnated RSI for use in 
those areas where improved dimensional stability and high temperature 
service are necessary. Applications of this material is currently 
found in localized areas where static seals are required, around the 
landing gear doors, the eleven and aft Orbiter/ET umbilical doors. 

The definition of environmental and dimensional requirements are still 
in the process of being refined. 

The thermal barrier designs for the Orbiter doors and other 
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critical areas have been completed and will be examined analytically 
to see what testing should be done to prove the adequacy of the design. 
One area of continued concern is the surface smoothness requirements 
over doors and other areas using seals and thermal barriers. If the 
current smoothness requirements were to be relaxed it could very 
well result in flow transition from laminar to turbulent at an earlier 
time in the mission that is used in the design and sizing of the TPS. 

For example, if the requirements on the nose landing gear door area 
were changed resulting in an early tripping to turbulent flow, the 
TPS weight might well have to be increased as much as 2900 pounds to 
handle the situation. 

4. 2.4. 5. 7 Leading Edge Structure 

The leading edge thermal protection design uses an all-carbon 
system protected against oxidation by a coating of reinforced carbon- 
carbon (RCC), The general design and installation is shown in 
Figure 4-2. The RCC system covers about 410 ft of leading edge 
surface on the Orbiter fuselage, wings and empennage. The 3,020 
pounds associated with this system is made up of some 1600 pounds of 
the RCC panels themselves and about 1420 pounds of installation hard- 
ware and internal insulation in these areas. Hie material is sub- 
jected to temperatures ranging from about 2300° F. to more than 2600° F. 
This material will be applied to two specific areas on the Orbiter 101 
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and extensively used on the Orbiter 102 for its Orbital fliphts. 

The on-going studies assess the capability of the leading edge 
structural subsystem to withstand cyclic aerodynamic and aerothermal 
stresses (fatigue properties). This work will be reported upon dur- 
ing the Orbier 102 Design Review scheduled for the April/May 1976 
time period. There are the number of Review Item Dispositions (RIDSs) 
remaining open from prior reviews that car be expected at this stage 
of the development program. All of these items are being worked. A 
sumtnary of the RID activity through the first of December 1975 is 
provided in Table 4-3. 

The interface between the RCC installation and the adjacent high 
temperature tiles (HRSI) has been designed with essentially complete 
layout drawings as well as completed stress and thermal analyses. 

Significant areas include the RCC attachments themselves and the ther- 
mal barriers internal to the protected surface. Thermal barriers are 
to be included in the development test program currently underway, 
i.e., "Wing Leading Edge System" and "RCC/RSI Interface - Nose Cap" 
tests. Additional updates are expected in the coming months to the analysor 
used in the current design work. 

It has been noted that the Inconel 718 metal in the fittings 
used to attach the LESS is very susceptable to cracking where small 
flaws existed and there is an air environment of 1000° F. or more. 
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This concern was discussed in some detail in the Spring of 1975 by both 
Rockwell and JSC. It was noted that on all released detail drawings 
that a reasonable margin of safety has been assured through the use 
of decreased material values (e.g., tensile strength, etc.) which 
accommodate possible cracks in the same manner as stress-corrosion 
is accounted for in the design of such items. 

4.2.5 Test Program 

The Thermal Protection Subsystem Test Program is extensive. It 
is being conducted at such locations as; 

a. Johnson Space Center - Technical management and develop- 
ment activities. 

b. Ames Research Center - Coatings development, material 
characterization, system development tests. 

c. Langley Research Center - Development test activities. 

d. Lockheed, Sunnyvale, Ca. - Development of tiles and 
coating and the production of tiles. 

e. Rockwell, Downey, Ca. - Development of total TPS system 
including the assembly and installation, design and development, 
maintenance and replacement procedures, etc. 

f. Johns-Manville - Basic tile material fibers. 

g. Globe-Albany, Maine - Supplier of Nomex felt. 
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For our purposes this status report focuses on material charac- 
terization tests, development tests, and certification tests. 

The current test status shows the following position at this 

time : 

a. Material selection tests are approximately 75% com- 
plete with final completion scheduled for June 1976. 

b. The material characterization test work required for 
the Orbiter 102 PDR is some 90% complete. This phase of the work is 
expected to be completed around July 1, 1976. Testing will, of course, 
be continued as required to meet any changes made to either the re- 
quirements or the material used in the TPS. 

c. Design development testing will be continuous through 
at least most of 1977. Verification testing is expected to begin 
sometime in the last half of 1977. 

d. A plan has been developed to assess the inherent cap- 
ability of the TPS to withstand such natural environments as rain and 
hail bird strikes. A major objective is the determination of that 
launch and landing constraints that must be considered in mission 
planning. 

e. The effects of a "lost tile" being examined in detail 
through testing at the Ames Research Laboratory. The objective of 
these tests is to determine the survivability of adjacent tile in- 
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stallations and their resistance to the so-called "zippering" etfect 
because of entry aerothermodynamic forces . Tliis work continues be- 
cause the earlier test results were not conclusive. 

The depth of the test program can be seen from the following 
examples of work being conducted at the Langley Research Center; 

a. Assessment of the leading edge carbon-carbon material 
to assess mass loss verify the mission life capability of this ma- 
terial and design. 

b. Assessment of the nose gear door thermal barrier to 
evaluate the design concepts for the thermal performance, leakage 
rates, and reusability. 

c. Determination of the thermal response and gas leakage 
characteristics of the interface between the leaaing edge high tem- 
perature carbon system and the reuseable tile system which adjoins it. 

d. Evaluation of the thermal performance of reuseable sur- 
face Insulation (tiles) to off-nominal high shear environments. 

e. Determination of the effects of tolerance buildup on 
the TPS performance under nominal (turbulent) flow environment. 

f. Evaluation of the effects of the sequence and/or combi- 
nation of mission environments on the TPS tile acoustic fatigue life. 

g. Assessment to correlate damaged tile erosion rate with 
flow shear, and determine influence of damaged tile on primary struc- 
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ture temperatures during entry. 

h. Definition of the design allowables for Orbiter lead- 
ing edge reinforced carbon-carbon material by determining the syner- 
gistic effects of stress, temperature, and pressure on mission life. 

At the time of the Orbiter TPS review in August 1975 a niunber 
of issues were considered: 

a. The methods of dissemination of materials property data 
by letter followed by revision to the materials handbook was reviewed 
and is considered acceptable. 

b. Materials test plans have been reviewed and the follow^ 
ing points made: (1) a plan is required and will be made available 
for the evaluation of crystobalite formation in fused silica materials 
(high strength/density) used in high temperature areas of the Orbiter; 
(2) a plan is being prepared to define the RSI defect and crack accep- 
tance and/or rejection criteria which is necessary for proper Orbiter 
refurbishment and logistics; and (3) a test plan has been developed 

to consider the possible effects of launch site environment on the 
mission life of tiles. This test will be implemented starting in May 
1976 and there will be analytical studies conducted concurrently. 

c. The planned NASA technology study has been established 
to continue the investigation of "lost tile" effects. This is men- 
tioned above as a part of the Langley Research Center program in 
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support of the TPS development and operational understanding work. 
Previous testing had indicated that tile "zippering" would not occur 
if a single tile were missing from the TPS pattern. However, there 
was some question about the effects from the loss of two or more tiles 
adjacent along the airflow path. Langley tests indicate that if flow 
reattaches on the bottom of the cavity wall where the tile is missing, 
unzippering is more likely to occur. This is due to the flow field 
undercutting downstream tiles and erosion of the underlying Strain 
Isolator Pad (SIP-Nomex Felt). 

d. The scope of the acoustic fatigue testing program has 
been reevaluated to assure that this program is adequate and timely 
in supporting design development. This was of particular interest to 
the designers of the aerothermal seals. There is a feeling that such 
acoustic fatigue tests should in fact contain a sequence of tests 
that used combined environments to assure that the seals are adequate 
to pass certification. This is another of the tests noted under the 
Langley Research Center support programs. 

e. The need for tests of the forward external tank/orbiter 

attachment region was reviewed. Thermal testing was not considered 
necessary because: (1) the attach/separation mechanism assembly is 

replaced after each flight, hence damage to this assembly during 
entry has no next- flight consequence; (2) analysis indicates the sub- 
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structure in the attachment region will not be overheated; and (3) 
the TPS surrounding the penetration Is mounted on a removable carrier- 
plate that can readily be Inspected and serviced after each flight. 

f. There have been questions regarding the certification 
plan for the TPS because of the use of prototype pre-production 
hardware tiles in development test articles that may be used in 
support of certification and the adequacy of the planned testing pro- 
cedures, especially in the area of acoustic fatigue. To assure an 
adequate certification test program it had been decided that proto- 
type hardware may be used and if similarity exists with flight hard- 
ware and is approved by NASA. The acoustic fatigue test program will 
be agreed upon sufficiently in advance of the tests themselves. 

4.2.6 Fabrication and Assembly 

In its 1975 Annual Report the Panel noted two areas requiring 
continued attention. The Space Shuttle Program office responded to 
these questions about design and quality control on the TPS and the 
procedures, instructions and training requirements for installation 
of it. (See Attachment 4-1 and 4-2). 

The TPS is still in the development stage; therefore, the detailed 
information regarding the process for installation and verification 
is also under evolution. Some of the statements provided at the TPS 
Design Review put this aspect of the program into perspective . 
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a. Non-standard tile shapes are required to accommodate 
close-out requirements, tile orientation to reduce gap heat?ng effects 
and the man penetrations, such as doors, windows, access panels, vents, 
etc. 

b. Tile shape and carrier strip geometry has been standard- 
ized wherever possible. Layouts, of course, are in various decrees 

of completion. Differences in assembly must be ironed-out as the 
design fully develops. 

c. The number of tools or arrays to be used in installing 
the TPS on the Orbiter is estimated as follows : 


Mid- fuselage 88 

Wings 50 

Vertical Stabilizer 83 

Upper Forward Fuselage 44 

Lower Forward Fuselage 130 

Aft Fuselage, Lower 33 

APS Pod 64 

RCS Pod, Upper Forward Fuselage 26 

TOTAL 517 


Such installation arrays are being defined as soon as the engineering 
layouts become available. 

d. The TPS inspection plans (15 May 1975) do not rely on 
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visual inspection alone as the initial method of damage inspect Lon. 
Demage, of course, can occur during assembly or as a result of the 
mission environment. The intent of the visual inspection is to iden- 
tify both those vehicle areas where there is obvious damage as well 
as those areas which warrant more detailed assessment because of the 
external appearance of the tile or similar data. This visual tech- 
nique is an effective process to identify areas of refurbishment. 
Detailed discussion of available NDE (Non- Destructive Evaluation) 
tests and future plans for such are contained in Rockwell International 
Letter 044-250-75-080, dated 5 August 1975. 

e. An example of the attention being focused on the instal- 
lation problem at this time is the assignment of twelve quality engi- 
neers to work directly with the design group during the current phase 
of the program. NASA has also assigned a quality engineer to monitor 
the effort on a full-time basis. In addition, a TPS development shop 
is located adjacent to the design area to assure continuity between 
the development testing and the design and quality verification 
efforts. 

4.2.7 Logistics and pfaintenance 

Much of what has been stated above for the fabrication „and 
assembly portion of the TPS program applies to the logistics and 
maintenance areas as well. These areas are receiving increasing 
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attention as the design moves forward. For example, Rockwell Inter- 
nationa is responding to a KSC request for a proposal to develop 
Space Shuttle thermal protection system refurbishment techniques, 
which consists of three basic tasks: (1) tile removal and replacement, 

(2) tile repair, and (3) thermal tile tests at KSC to verify repair 
methods. 

These tasks started in October 1975 and will be completed on or 
about October 1976. 

Handling and packaging specifications and procedures are to be 
prepared so that the documents covering the TPS handling, storage, 
transportation, inspection, bonding, machining and coating, and water- 
proofing will be published and ready in time to support the TPS fa- 
cilities activation at the Palmdale assembly plant. 

TPS tile identification methods are under active consideration 
with a goal of identifying the tiles with an applicable Rockwell 
International part number and serial number on the bottom surface 
of the tile. 

4.3 Current Posture 

Although basically a new system, the program considers the 
Orbiter TPS concept appears to be both practical and workable. De- 
sign and development testing appears to support this judgment. An 
example of the maturation of the TPS design is the large reduction in 
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the number of thin (0.20") tiles resulting from the refinement >f en- 
try aerothermal loads and the development of coated Nomex felt for those 
Orbiter surfaces having expected temperatures below the 650-700° F. 
range . 

Based on the data available to the Panel, the following is the 
status of TPS development; 

a. It is expected that 95% of the layout drawings would 
be completed by April 1976. 

b. The TPS design, fabrication, installation and test 
activities should meet the Orbiter 102 program milestone requirements. 

c. The TPS system design reviews are effective in surfacing 
those kinds of problems requiring the attention of management and the 
working levels to assure the TPS meets the requirements on Orbiter 102. 

d. The Solid Rocket Booster separation rocket engine plumes 
do not appear to present an impingement problem. 

e. The basic TPS materials have been selected and the 
"acreage" configuration have been baselined. The interface config- 
uration between the leading edge RCC system and the basic tile system 
has been finalized. 

Specifications and test plans need to be completed as follows; 

a. The Lockheed Missile and Space Corporation specification 
on "heat-up" and "cool-down" rates to assure the tile materials meet 
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Orbiter requirements requires further definition* 

b. The material property data in Rockwell International 
handbooks used by design and test personnel needs to be updated. 

c. The TPS Design Specification, SD72-SH-0101-6, is to 
be updated and completed on or about July 1, 1976 by Rockwell 
International. 

d. Requirements for acoustic fatigue tests need to be 

verified. 

e. There needs to be a demonstration of a full 100 mission 
life for the carbon/carbon leading edge material (RCC), especially 
for that section of the wing leading edge where the shock wave off 
the Orbiter nose intersects the wing. 

f. Aerodynamic heating in the gaps between TPS tiles is 

a problem where much effort is being expended at this time. This is 
most severe in those portions of the tile system where a large pressure 
gradient is present causing increased local flow rates, such as on the 
wing glove area at high angles of attack. 

g. A test and analysis program must be defined to prove 
that the coated tiles can meet the waterproof requirements necessary 
for re-use. Coating development activity indicates that this is a 
difficult area and resolution is expected in mid-1976. 

h. The requirements for Development Flight Instrumentation 
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(DFI) for the TPS are fairly well-defined. The program is in the 
process of deciding the type and nuicber; the location of sensors 
in regards to edges, tile gaps, structural members; redundant in- 
stallations and effects of data point drop-out. The organizational 
responsibilities for various aspects of DFI must also be defined. 
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4.4 Addendum 


The program has just completed a major baseline review and made 
number of significant decisions. 

4.4.1 Tile Coating 

The Ames Research Center "RCG” coating has been selected for the 
high temperature tiles (HRSI) based on the most recent test results 
and detailed studies. This black coating should eliminate the coat™ 
ing cracking problem experience during the past months. The original 
grey-colored coating will be used on the low temperature tiles (LRSI) 
which has not experienced the cracking problem. The thermal properties 
(emissivity/absorbtivity) appear to meet requirements. 

4.4.1 SSME Heat Shields 

The thermal protection system design for SSME base heat shield 
is shown in Figure 4-3. This shield protects the Orbiter and engine 
structure from heat transfer during the ascent and entry portions 
of the mission. It has been estimated that one-half of the shield 
on a single engine may have to be replaced every four or so flights. 

4.4.3 Themu.l Seals 

The Orbiter body flap and wing/elevon lower cove aerothermal 
seals require failsafe design. As presently designed these may pre- 
sent a single point failure condition which can be considered a crew 
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safety hazard. Furthermore these seals as designed are dynamic systems 
so that safe-life cannot really be proven and Inspection for failures 
Is extremely difficult. Although these seal systems Include springs, 
hinges, linkages, rubbing plates they are not subjected to the form 
of failure mode and effects analyses (FMEA's) used on other mechanisms 
because they are consldred to be structures. The contractor has noted 
that reliability trade studies have beer, conducted to support the de- 
sign avid development and the !,3st program. 

The test and analysis program for the seals is directed toward 
demonstrating that; 

a. Sufficient structural and performance margins exist so 
that there is no credible single point failure in the seal system. 

b. Sufficient access and ground test provisions have been 
provided to pemit inspection and tests to prove flight readiness. 

c. Where structural and performance margins cannot be 
demonstrated the design shall incorporate sufficient thermal protection 
to accommodate a safe single entry by means of insulation, heat sinks, 
etc. To assure hat the current design approach meets the requiremer.i'P 
the contractor has been directed to rwiev/ the following areas and 
develop a plan and a schedule to (1) determine if the present design 
can be made failsafe for all flights, (2) reassess maximum gap size 
allowables, (3) determine if additional test program will increase 
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confidence, (4) investigate the inspection and maintenance cone- pts 
for increasing the ability to meet turnaround times, and (5) Investi- 
gate potential modifications to early test missions to enhance the fail' 
safe concept. 

Other areas of thermal seals still being analyzed include tne 
following ; 

a. The impact of accommodating early boundary layer tran- 
sition with particular attention given to the forward landing gear 
door and the external tank/Orbiter/ forward attachment points. 

b. Use of redundant seal systems based on the results of 
the activities noted above under the eleven and body flap seals. 

c. Payload Bay Door areas. 

d. The External Tank Umbilical Door seal. 

e. Mechanical properties of thermal brush systems used 
in the seal and barrier systems. 

f. Door rigging on those doors that might have significant 
deflections during the mission. 

4.4.4 Thermal Barriers 

In addition to the thermal barrier materials used in the seals 
around doors and the like, there is also a need for thermal barriers 
or "gap fillers" between tiles c^nd between tiles and adjacent structures 
such as windows, the eleven trailing edge, the wing glove and chine, 
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etc. Results from wind tunnel tests clearly indicate that gap heating 
is significantly increased when flow is driven by a high pressure 
gradient. The amount of heating increase is dependent upon the mag,- 
nitude of the gradient. For example, a gap temperature of 1490° F. 
is experienced at a surface temperature of 1400° F. while a gap tem- 
perature of some 2000° F. resulted at a surface temperature of 1600° F. 
General areas of the TPS where pressure gradients exist &nd where gap 
fillers are required have been identified. 

Concepts devised to meet this problem include; 

a. Thermal brush bonded to tile sides. 

b. Glass fabric shapes bonded to tile sides- 

c. Saffil fibers encapsulated in Irish Refrasil material 
and bonded to the filler bar currently in use, 

d. Saffil fibers plus a knitted wire mesh spring encapsulated 
in a high temperature fabric (AB 312) and bonded to the filler bar. 

Since the bonding of the tile and coating has not been satis- 
factory to date, the program is considering the use of Saffil fibers 
made into a brush (Saffil = silica fibers) or encapsulated and bonded 
to the filler bar rather than the tile coating. 

These designs are being tested both thermally and structurally 
at this time. 

4.4.5 Tile Step and Gap Effects 
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Thoi’o oppoai’fi to l>o a itvoat doal ol dilJikult iu niaiiUaittit\j' tlu' 
fmuill/r,top and gap required betwoon liloH -.o provont oarly boundary 
layi'i’ trail!', ition. For instanoo tlu> iioso laudliif, r.oar door thormal 
barrior arr’anj';omt*nt produce.*, a 9.0.'‘i-inch atep at Forward and alt 
door oilp.ea compared with preaeiU requirement a lor not more than 0.017'- 
incli iitep, ‘rtie }*ap between thermal tiler, at the aanu' door cd>*e!! are 
in exeesiti ol the requirement tor 0.0'Kf-ineh wiiltlv and 0,014-inch depth. 
Analytical and tciU work continuea in aucU arena to briny, the atep and 
yap problem within allviwable houiula. 

4 . 4 . t> Structural Themil Analyse!'. 

The approach to the .alructural thermal analyaia ia auch that it 
aupporta the development ol fitructural ,'ind TPS deaiyna that are inter- 
dependent. Tile time that it take.**, to do a complete thermal and aireaa 
analyaia calculation or ileiMtion on a previoua calculation ia quite 
lony, Hieae proyraina are larye, complex 1-dlnu'naional mathematic.il 
modela requiriny conaiderable manpower and computer uaaye. Tlie.se pro- 
yrama do not include .ill thri'o-dimension.il et’lecta that iiitluence tlu’ 
.structural temperature yradienla because iirbiter deaiyn .scheduler, pre- 
cludi' that level ot detail. Those three-dimensional ellects provideil 
a.s yiven inputs are parameters that vary lonyitudinally as well ;ia 
t rails ver.sely, e.y., TPS thickness, heal loads, primary structure, and 
TCS in.sulatii n. The Contractor's TPS mitiinmm weiyht thermal desiyn 
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and analysln philosophy is to ostablish UJM thicknot'.s roquiivnu'nt r. 
and vohiclo tompi'X’atux'o vosponse based on nominal ihormal analViU'!’. 

£or aboi’ts as well as nornuil WTR and KTR missions. Ml these an.ilvtu'!. 
are plamu'd to be aeeomplished at a level ol detail consistent with 
Shuttle pro^ti’am lundlnit and schedules. Final vehicle overall lhei*mal 
and structural capability is to be determined throusth a pi’op.ressive 
illj’hl lest prop, ram. Predicated on ilipht test results, desipn modi- 
iicat ions can be ellected if requiri*d to maintain .uiequate vehicle 
operational capability . 
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ATTACHMKNT 4-1 


The* (Irsn'qn and quality coni rol for the doom, Thermal 
Prolcciion f*yntom ponot rations and thermal seals oluaild ho 
closely monitored by manaqement to assure that the rc'liahi- 
lity m‘cessary to satisfy safety will be achieved. 

Kojqnmse^: The criticality of reliable de.siqns foi doors and nihor 

piMielrarionr llurough tlu- TPS an<l the associated siaiie and dynamic 
se.jls is rc-cofjniv'.ed by manacement. The clor.imi and latchimi iiu cha« 
nisimi for 1 Jie doors lUid Imtclios wore .identified c.r srp's in tiic‘ 

I’Mi’A as leading to failure to dost' and s*ot('ntial cat o«Tory 1 cftocta- 
Theso critic.il mcch.inisms ard rclat(*d thermal seals have also h- on 
identified in the Orbit, or Harar’tJs Analysis. Cono. m was cx}<r<5*.';tHi 
about the i nmi.i I urity of d(‘sign of this cart of th-- thormal pmio.*" 
tion system during Iho TPS PDP for vehicle 10? coedacted in oar ly 
Angust . Schodul(i miloslones have been I'st aJ'l i sh«'d for ncvU t.i’m 
.id juslim-nl s in the dcsiifn cffm-l to assure' Sf.ti s f ac l.oi’y mai.pns. 

Till* 1‘roitram niioctor h.is boon a|)i>rised of the st.ilu,*; >nd .i. i\ini.! i :.li 
inent of tlu' milestones will bo monitored. 

It should .ilso be noted th.it lli'* ovi’i'nll .Su.rce .Shuttle* de'sien h..s 
Ire'on revie'We'et with the* objective of minimizing the numbe'i ed 
pe'iict I'ations . For I'X.imples, as .i i e‘'sult ('f * review of door-:. 

.'uMuatc'd in flight, t h-e forw.n d l.c.'T. instal.1 tion w.is motlifiio to 
t'liminafc* the dex^rs. 
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_ * 


The procedures, instruofeions, and trainin'? requiii'nif'nt ?• iej 
xnjitallation and quality ecntrul the Thermal Prut eot ion 
System components should be reviewed by program nunaqement 
to assure the nero/thio modynami e requii (Muent n are '‘let . 


Response; The TPS (Thermal Protection System) is. sit ill in the 
di'veiopment stage; therefore, the detailed intotnition r('aarvlinq 
the process} for ins.tallation and veriFicMtion ot the TPS is itli, - 
under development. Significant attention is? being focurt d oji thi. 
area by both the contractor and NASA. Tor tuc.smple, to as'.suirt' 
timely aitd adequate developin' uit of quality critiuia for the TPS 
Installation and vitrification process, the contiaetor h.e; asnign'Ht 
1.’ quality engineers to work directly with the dfsiign group dmin'i 
the dessign and di'vt lopment phasic of the (»ffort. NASA has .iss’igii' *1 
a quality esngineer to monitor tlie effort on a lull time Ivi*!:;.. 

A TPS development shop is loe.itcd adjacent to ilu- iler.iqn .uca to 
asisure continuity between the development tesMii'i .md the di *•. iisi 
and quality verification ef fort s. N!U) (nomlcst i net i vc cvMluationi 
techniques} are currently beinu devel-hii'd and U s;ted to .issui-e 
deteetien of delamination of tile bonds, matei ial voids, er.ieki;, 
etc., following insstallation and fliglit. Perso.i’aot training uni 
certification requii'cmcnts aie being developed eonmirrent with 
the installation and inspection processes. 


beiMuss* 


Tile TPS is an ax'en of great ermeorn to manageuiciit and it ii 
of this concern that the action was taken to assicin design, 
quality engine.ering , and manufacturi ne eersionnel to develop the 
necessary verification proccssies concurrent with develoonu'nt of 
the design. Frequent reviews-, are conducted i>y bvviii the contractor 
and NASA mariagement to maintain full visibility oj progress and 
problems oncountei’ed in the TPS development. 
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TAm.M A-l 
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TABI.B 4-2 


DOGl'MHNT'^S ASBtiCTATKD WITH Or^RTTl'H TP^5 


1. Orbitin' Thermal Protect ion Subaystom (TPH) I)e«i>',n Revim-j 
Hoard Mlmitea . lA AuRuat 197 5# 

2. TPS Deslp.n Review summary brief inRS, syst«‘ra description briefing, 
team board briefinRS, Review Item Disposition Suimnary, RID and 

team minutes; all published in RI document {JSV79-24-1 dated 14 Aur 7'». 

3. Typical RI Internal Letters relating, to TPS: 

"TPS Bvaluation of Updated Design Trajectory Mission 3n" April 30, 197'* 
"TPS Evaluation of AOA Trajectory-Nominal ITl’R" June 16, 1973 
"Thermal Evaluation of OML Faired TPS Thiclcness for OP 102" July 24, 1973 
"TPS Evaluation of ETR Trajectory With Dispersions" August 1, 1973 

4. "Shuttle Orbiter OV-101 CDR Safety Analysis Report Volume I- 
Management Summary" 13 September 1975, SD75-sil-0133-001. 

"Shuttle Orbiter OV-101 CDR Safety Analysis Report Volume II- 
Structures" 15 September 197.3, SD73-SU-0133-002. 

"Shuttle Sy.stem.'i Safe.ty Analynis Report" June 13, 1973, SD75-SII-0Q64A 
"Space Shuttle Safety Concerns Sunmary Report" 3 September 1975. 

"shuttle Orbiter 102 PDR Safety Analysis Report (Update), SD74-SH-0323, 
dated July 1, 1975. 


TABI.1'3 


Rovii‘w It(>m nispoBitlon (RID) 
Ffom Pro.vlotin Ri>vi(n ?s 
SL'Ill Opo.n 

LESS/HRSI Gap/Sti'p Tolerance 

BESS structural ami Dynamic Analysis 

I,ESS/HRSI Internal Insulation 

RSI Attachment Around Windov;s 

Thermal Deflection of RGG Expansion Seal 

LESS Desifins for Baseline Trajectory 


) 

[ 


(These indicate the areas of some concern from a standpoint of desip,n 
completion and understanding of the problems involved if not resolvedl 
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Tabli* »“4 


Fi‘lt Ri>ufli*ablt‘ J’ui’l'at’i* Inniilatiou tFRHT) 


1. Thin la Nomt'K or "H" folt eoattul v;lth white ailieom* osi«l<' uk m ■•.m 
Tho use of this mafcrinl in He«t of tiler, aaver. about ^4i pouiutr. 


Physical Propertier. 

“ Maximum allovjable temperature for one mir.aiou 000* P 

- 100 Mission Life Maximum allowable temperat uri“ 700‘V 

“ Dennitv, lba/ft2 with thickness of 0.4 inches 0.1*4 

“ Goatinp, thickness (r)t:‘t.‘-007') 0.007‘» iiuhes 

“ Area covered, ft*’ .’HtiO 


4. Manufac Ctirinp, process 

Nomex felt is heat treated to ?00‘^F for 30 minutes, then if is 
treati'd at a raised temperatur»* of y^O^^'p for another h) minutes. 

This accomplishes the pre-shrinkap,e step. After application of 
the, coating (DCO.’-OO?) there is a post cure for I*) minutes at bhO'V. 
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5.0 AVIONICS mNAOKMENT 


5 . 1 Introduction 

The Shuttle avionics system provides command functions includ- 
ing, their implementation, guidaiice, navigation, and control capability, 
communication, computation, displays and controls, instrumentation, 
and electrical power distribution and control for the Orbiter, Exter- 
nal Tank, and the Solid Rocket Boosters. Tlterc are also provisions 
for the management and control of payload functions and for the 
communication of data to and from payloads. 

Avionics t^as placed high on the list of ureas to be examined and 
assessed by the Panel because the fabrication^ test, and verification 
of the integrated system of avionics hardware and software is vital 
to the success of the current phase of the test program and later 
mission operations, and it is an area most likely to affect and be effected 
by resources and schedules. 

Attachmei.i’ 5-1 is the Shuttle On ice response to the Panel's con- 
cern that the management system for avionic hardware and s«»f txi;are 
should be reviewed by senior program management to assure it is 
adequate for the indicated complexity of the program. 

Shuttle Orbiter avionics for the purposes of this discussion falls 
into two identifiable areas; (1) the Orbiter 101 avionics used dur- 
ing the verification testing and Approach and Landing Test project, 
and (2) the Orbiter 102 avionics used during the orbital flight tests 
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.iihi initial llif’.hlo lollowina. I'DiV.H. Tlu' iibilnr 101 avionikM! .‘iviil I'lii 
pi’i'viOo'j iho lUH'Oi'.'uu’y aip.nal iU'qui ni t ion, hamilinp,, priH'i'Si’.inp,, »Uti“ 
pLiv ami pi'win inp, to onablo llio navip.at ion, oonlrol, ami iniovmalion 
ini orohanp.o ivquix’oii lor tho approach ami lamlinp, loai pro joe t . 
i?pooi t ioal Iv, tho avionic;', ayatem lor Ovlntcr 101 conlaiiia: 

. i . i^i i d * J i' 

(11 Throe Inertial McaiUirinp, Unit;! (IMO). 

(.’1 N.ivip.at ion Hasc (Nnl. 

(11 .qo It ware in the pa'iural purpose v-omputer,'!, 

’ Mr P.it.t 

(11 A sensory tivr.tem to mcafiviri' static prettsure, total 
pressure, lower ami uppi>r alpha port preiunires, ami imiicateil total 
air ti'inperaturv. 

( ’1 Air Pat a Trantuiucer Assemblies to provide di;;ital 
ini'uts irv»m the sensine, systi'in to the pa'ttor.il purposi' computers. 

(11 Probes that are mechani /ed lor stowap.e and do- 
plovment .is required. 

(>il Ipccial .ic. odynami c probe mounted on a boom 
.utached to nose ot tlu' oipitcr with a dcdicatid separate air data 
computer and pam'l mounted displav;.. llii s sep.irate svsiem is used to 
calibiMte the operalion.il system. 

‘‘ • Hi edit Oontrol 
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(1) Oi’biliU’ 1(U luin a biu'kup oi»utrol isyut nn 

tho iiuk'pomloiU aiv daia !U‘i\!ior» and di'dicatovl p.i'tu'ral purpofU' 

compulor a!) an altornaio lo tho primai’y lUp.ht ooutrol lunotion. 

( 2 ) Mip.ht ounirol oomponouta Involvt'd in tho avlonii- 

to-aoluatov intoriaoo aro: 

Rato p.yro aB»ombly 
Ao 0 0 1 i‘ fomo 1 0 V a !J «omb ly 
Rotation hand . ontrol 
Spood brako thruat oontrol 
RuUdor podal iransducor aHaoiubly 
Ai'i’oauriaoo tu'i'vo amplllioi’ 

Roaotlon jot di'ivor iorward 

Roao 1 1 on jot/ iiM;> vlrivi'r 

Aaoont thruat vootoi: control driver 

(t) Flij'ht control dinitiil autopilot tiottwaro to pro- 
vide tho baaio llip.ht oonlrol lunotiouH. 

• ronimunioal ionti and Ti\>oklno, 

Tho RF, proooaainp,, and diat ribut ion oquipmont noooaaarv 
to provide tho many input, output and proooas aolivitio!!, 

• hiaplaya and t-ontroLs 
(11 Font 1*0 Is 

Rotation Hand Controller (this is noted above as' wo 1 11 

Rudder podal transduoor assomblv (.tliis is noted above 

as wo 111 

Speed brake Controlli'r (lliis is noted abovi' as welll 
Keyboard used lo interiaoe with tin* I'.RT dio.plav aiul 
to manage the iniormation displayed. It is also used to provide entry 
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10 tu'nd I'ontrol connnanda to the oompulora. 

Dianlava 

(a) Attitude Director . leator (iwo-asia, roll '.nd pitch). 

(b) Surface Poaition Indicator (lor aero-controla) 

(c) Alpha/Mach Indicator 

(d) Altitude/Vertical Velocity Indicator 

(e) Uori.’ontal Situation Indicator 

(f) Orbit er Diaplay Unit (CRT flip.lU computer inlormatlon) 

(U) Computer Status Annunciator Assembly 

(h) Fire Warning Annunciator Assembly 

(i) Caution tmd Warnin}<; Subsystem 
s' * Instrument at ion Subsystem 

This consists of sensor transducers, signal conditioning 
c(iuipment, Pt'M encoding equipment, frequency multiplex equipment, 

PCM tape recorders, analog recorders, timing equipment, and on-board 
checkout equlpmeitt . 

Tlte system is made up of two separate parts: (1) the 

opera* ional instrumentation (OD, and (2) development l light instru- 
mentation (DFl). 

h . IVita Processing and So It ware’ 

(1) Five general purpose computers (UPC). 

(d) Two mass memories - magnetic tape memories for 
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laiy.o volumo bulk ntorajt'c ami oiY.anlaatlonal inlomaiiou. 

{.\) Kij'htoon Mull iploM'r/lVmult iploNorr. (Ml'Ml. 

(41 Romoto iuii'vlaao unit a iv> couvinM ami loviuat ikita 
al ayatom Intorlaoo. 

('0 Mull 1 imu'l ion I’athmio Rav Tubo (i‘lU’1, iluvo oi 

thoao , 

(bl lUi'.play Ryslom. 

(71 ivua Pus »uul aa.'UH'iai ovl o(iuipm»'ni . 

(81 Roll warn lor all oompui ora . 

^ • Kloolrloal Powor Pi al ribul io_n 

Thia ayatom providoa powor viial ribul ion ami powor oon- 
irol lor all Shull lo Syaioma during v'poraiional phaaoa, li inU'riaooa 
wilh all aubsyaloma thal roquiro aipnal powor ami oporalional powor. 

Followlnp, aro tho ohanp.oa lor lUo Orbiior 10.' oporalional tvpo 
vohiolos : 

a. Tho Star Traokor ami Up, hi Shado Unit!! aro addod lo tlu' 
Ouidanoo, Navipalion and I'onirol ayalom. 

b. Romoval ol >'ir vlaia ov'inponont a uaod lor oalibrat :,.n 
oi iho ayalom durinp, Orbiior 101 loal phaao. 

0 . Addition of S~band. 

d, Tho Knpino Intoriaov' Unil \iaod bi>two»'n iho ih’biU'r o\m- 
irola and the SSMK will bo added lo oommaml and alalua iho SSMK liurinp. 


Ill 


Ol’bil.il I'lij'.bt. A brii'l overview ol the operaiiouiil e.yiUeiu if) fshowu 
In FifUive S-1, and the Data Proeeooiny./tiot t ware arranp.enK'ut ia ahown 
in I'ij'vuv 


'* • •’ tteneral Purnoae t'oimniter uUH*) 

In the tirbiler 101 there are live UPr'a in the Orbiter on-boanl 
I omputat ional eomplex. Pour ot the iJPO's ai’e aynehronieed, eontain- 
inp. the identieal primary prop, ram loads? . The lilth ttPi' on the AM' 
phasse oi Orbiter ]01 if? dedieaied to tuipport the backup llipht contrvU 
syatem. Thif? backup llipht control aystem if? a primary tiaiety tunct ion 
in this phase ol the propram. 

Mach itPl'. it? a modilied IPM AP-lOl micropropram eontrol’rd iVntral 
Pi'ocettfsinp Pnit (I'PO't with a \mique Input/Output Proeestsor interlace 
to the sserial data bus? network. Tl\et?e two line replacciible units?, 
the I'Pt? and the Input/Output Procetssior, contain portions of main 


numiory which are ussed bv either the I’PU or the Input/Output Procettssor 
on a nondodicatod basis. The CPU initiates all input/output actions 
tlmniph the execution oi Instructions? to the processor. These in- 
structions and data words tire translerred between the I’PU and the 
Processor on a bidirect iontil, parallel word d.ita bus. Kxcept lor 
initiation, the proeessor is indepeiiiient ot the MPU and executes its 
owl proprams, which reside in the coimnon main memory. Read-only 
storape is used tor controllinp a fixed sequence ot operations and 
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internal Uaia paths t>» bo oxooutod tor oaoli inr.l riioi io-u 
' Ihitif qrman o t\ Mo n 1 1 o r i np , t ty «J o.n y 

Tho I’MS on th'bitor XOl is eonsiilorablv loss oomplox than tho ono 
on Orbltor 10? which is used for orbital missions. Tho Orbitor Itfl 
VMS as usoil dnrinp, tho AI.T proioct px’ovidos for automatic {unit di'tooti.is 
and annunciation, and svibsystom moasuromont manap.omont. Additional PM!^ 
functions far Orbitor 10? OFT and operational missions includo tho 
follov;in^t: (H subsystem confipurat ion manapomont, t?l consumables 

maiia>tomont , (11 data record in>wnana>^'mout , (dl tolomoiry format select i»'u, 
(ll payload support, (bl mission proper storage and retrieval, (VI per- 
formance evaluation and trend analvsis, and (01 conlinp.ency planning, aid. 
The smaller 101 I'MS prop, ram is resident in each oi tlu> four OPO's used 
for the primary flixtht control syraera. 

Automatic fault detection and annunciat iv'u detects subsystvnu failing’s 
at the functional path level, which is the level corrective action can be 
taken in flipht. This system is implemented through the avionics sv'ftware. 
When the failed parameter is t>ne of the safely critical cautii>n ami warnine 
parameter proup items a backup caution and warning master alarm sipnal is 
generated. A PMS crew alert alarm consistinp. of a small blue lip.hl and a 
short duration burcer is initated when any parameter is declared fa i It'd, 
Thus the PM.S provides a backup capability for the hardwired t’aut ion and 
Warninp. subsystem in alert inp, the crew* to any deti'ctt'd hazardous or 
potentially hazardous condition which requires attention. 

The Subsystem Measurement Manap.ement software enables the crew 
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vail upon the t’RT the meaom'emont data no the erew can aasenn the 
dep.rie ot a problem. 


Orbiter Avionie.'i lustallatlou 

The major portion of avionier, van be lounJ in the tlip.ht »b'ek, 
tile three torward avionleo equipment baya, and the thret> alt avloniea 
eciulpment bays. All antennas, except those used exclusively lor 
satellite tracking and KVA communication, are flush mounted on the 
top, bottom, and sides ot the Orbit er forward fuselafte. llieoe antennas 
include : 


a. Four S-band seven-element antennas for phase modulated (PM) 
conanutiic,ation with spaee/ground link system and STDN ground j-.tatlons and 


the NASA tracking and data relay satellites. 

b. Two S-band FM antennas. 

c. Four C-band horns for the radar altimeter. 

d. One UHF antenna for KVA/air traffic control voice 


connmmicat ions. 

e. Six I, -band TAitAN antennas. 

J . Three Ku-band microwave scan beam landing system antennas. 

g. One integrated Ku-band communications/rendezvous radar 
antenna and one Ku-band communication used with the NASA Tracking and 
Data Relay Satellite, 

h. One S-band PM payload antenna. 
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5 . 6 Orblter Radio Frcnucneloo 


Tlie Orbiter carrioo up to 23 auconnao for comnunieation v;ith 
f', round utationo, detached~payloado and crewmen doini* EVA. Tlioy uae 
B“, Ku-, L-, C“, and P-band frequencico. Table 'j-1 ohowo the syetom 
function and the Orbitor frequency for transmit tine, and for receiving: 
sij’nalo . 

The Ku-band links the j*round stations and the Orblter via the 
TracUinp, and Data Relay Satellite iJystem. It carrii;o the same kinds 
of inte,llif',ence as the S-band subsystem, but at vjider band -widths and 
hitcher data rates. Tlie Orbitor rendezvous radar and the ^{ultiple 
Scan Beam Landing’ System also works in the Ku-band. Tlie Ku-band systems 
capabilities and vehicle locations are shown in Figure 5-3. 

5.7 Microwave Scanning Beam banding System (MSBI.S) 

The MSBLS will provide information to he Orbiter avionics com- 
puter during the critical autoland period of flight. Tlte MSBLS is 
used during the last 75-seconds of Orbiter flight. Mxile the nominal 
acquisition range is about 12 n. miles, the range in practice depends 
upon Orbiter flight path, attitude, and weather constraints. 

Thu system consists of the ground station and an airborne navi- 
gation set. The ground station is divided into an elevation equip- 
ment group, Figure 5-4, and an azimuth/distance measuring group. 

Figure 5-5. The airborne equipment is divided into a decoder-re- 
ceiver unit and a DME transmitter unit. Figure 5-6 shows the major 
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oXemeuto and the radio^lrequeney linUo vjhleh an uaed in the Iftlilr!, 

, 8 Avionlen T.abogatorier. and Tent Plan 

'there are three laboratories os major slfdsil-ieance to the avionit;) 
lest prof.ram. In principal the Boltware iK'velopmeiU laboratory at 
.18C is tor the development ami verilieatiou o) soltware. The Avionics 
Development Laboratory at UocUwell International is lor the evaluation 
of avionics hardwarc/softwarc. The Shuttle Avionics Integration Laboratorv 
at JSC is for the validation of tho Integrated avionics hardware and soft- 
ware system. In practice the laboratories are also used as needed to work 
through technical challenges. Tlie lollowing sect ions describe each 
of the laboratories and the test program for validatiini ol Orbiter 101 
hardvtare and software lor ALT. 

b . B . 1 Software Development Laboratory (8DL) 

Tills facility at JSC is used for soltware coding, j developiiunt 
testing and for verification ol the flight softvMre. It provides tlie 
capability for high fidelity execution of flight soltware, varial)h 
fidelity simulations of vehicle and avionic subsysums fo provide 
nominal and off-nominal performance, diagnostic aids to force test 
conditions and collect /analy.;e results, and an automated and r.cmi- 
automateil set of techniques to provide rig.orous soiiware emit ig- 
uration management . Tliis facility has been operating, in support ot 
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l\u' SAIL ami Palmdale Plant ehoekout work. 

5,8.:’ Avi onlca Development Labocat orv_(AI)I.l 

The ADL io an enj'ineerinp, tool with emphaai'! on avionieo hardware 
devoloproont, subayatem evaluation and initial hai-dware intonration, H 
io 30t up ao shovm ochematieally in Fij:';iive 3-7. Tlu'o facility in locate I 
at Rl/Spaee Division, Dovmey, CA. The major ADI, flip.ht control tooto cover 
the test and ehoekout procedures for the Orbiter 101 at Palmdale; the 
Backup Flip,ht Control Syntem (BFCB) closed-loop performance.; the prinrirv to 
BFGS switchover; primary flij^ht control system performance testinr, and 
actuator tests; and closed-loop tostinfi with the Flight Control Hydraulic!! 
Laboratory (FCHI.). 

The status of v?ork being done, at ADL is oummarl:;e.d as: 

a. Software evaluation toots are in process on those tapes to 
be used for test and checkout of Orbiter 101, The programs or tapes to be 
used include SU-1, .Sb-IA, VP- 101 /ADL- 3A, FACT, ADL-'lB, OPS-9, HP-89, and 
ADL- '3. These tapes will also support the SAIL integration testing,. 

b. The ADL is using tv/o production general purpose computers 
(GPC's) to support the dry runs of test and checkout procedures and 
memory loading tests for OSE support. 

c. Both Single-string and Multi-string open and clost^l- 
loop engineering studies are Being done. 

d. Work load at ADL now and in the future will be quite 
heavy to meet the required evaluations and verifications. With proper 
scheduling and no major problems this work load should be accommodated. 
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® ^ Avionicn Intcnu’at ion T ahor.uory (i!AI! j_ 


The HAIL at ,THC ^’,ivoo NAHA the capability tor etAi'usive eloMod- 
loop raiooion evaluation ot the aviouieo oystem ao If v;ill be used 
in tli}'ht. 'jliio capability includeo testing, ior npeeilie oft-noralnal 
conditiono. Aftev outlinin}', the nct»pe oi the aetlvitieo planned iov 
HAIL, the differeneeo between the equipment uned in HAIL and tlu' equip- 
ment to be llown on Orbiter 101 are dlseuooi'd to provide an under;) tatulinp, 

oj the, capability ol the HAIL to oupport Orbiter development and ilif,ht 
pr*p trains • 

Teot Activitief) 

To Hive an idea ot the ocope ol ehe total HAIL teot activitieo, 
a tirief definition of the four tent phaoeo io an tollov;n: 

PHASE I TKHTH - Activation and eotablinhment ot the operational 
capability ot the HAI! checkout ohould be completed by Huly/Aupust 197t» 
time-lrame. A proLotype/breadboard veroion ol the avionicn tent hard- 
ware will be uoed, 

PHAHK II TESTS - tirbiter avionics sottv/are nyotemo perform- 
ance in oupport of the ALT prop, ram requireraentvS will be verified dur- 
inp, thin phanc. Priority han been nlaced on verifyiup, the Piaekup 
Flipht t!ontrol soltware and then utiliainp this coniip.uraiion to 
buildup and intep.rate flight systems. It is eKpccted that the Soft- 
ware Development Laboratory (SDL) soltware v;ill be utilised tor the 
buildup of those i light systems not covered by the P.F(T>. The linal 
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ilij’jUt oysLem buildup, intCf,railon, and laboraiovy wriJicaiion will 
be aceompUahed with those ooltwaro tapes or pror.ramo desie^uatod an 
VU-lOl til, FACI, and OPS-01 Pre-rcloaoo. lliio oottvwre is 

used in order to have SAIh ready to support closed loop testin}-, in 
September /October 197b period. 

PHAdH in THBTB - Testlnf, will be conducted to support the 
orbital flip,ht miosiono. 

PHABK TV TKHTt; - Teotinr, will support the dhuttle avionics 
operational requirements, lliuo there will be update ol SAIL to the 
required hardv^are/ooftwarc conl’if'uration. 

S . 8 . '3 . 2 . 1 Sinmlated Surface Actuators 

A special purpose electronic simulator has been desif^ned and is 
being built in-house at JSC to appear functionally equivalent to tlu' 
real hardware and interface directly v/ith the hardware aerosurface 
actuators. To assure the simulation is aderoate, the system functions 
xvill be compared x^ith those from hardx^aro at the flight control hy- 
draulic laboratory and from the Orbiter 101 vehicle. This comparison 
xHll cover (1) position gain and phase shift versus frequency, (2) secon- 
dary pressure monitoring, and (3) vehicle/ flight control system closed- 
loop structural mode stability. 
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'viuTc (>ro(otypi‘ tHpiipracnt in not'd it in plannt'ti to n't clo tlunn aUiT 
thoy iKOvt' Itt't'u nutdifit'd an»l npdaft'd tt> maintain iniirtittna] oqiiivaifncy 
with 1 lir.ht-typt' handwar*'. 

, i , . t nt'jyi;_l pj>m('jnt ,X l Jn Jj^n 

Omionions an* in the nennoro and harm'oa mn-nially conne< ted to thf 
operational inntrnmematit'n rmilt ipleKera/dt'mnlf iploHera, Tht'oe do nttf 
alfeet tlu' flij'.ht control nvnti ni or the data proceoainy. nyateia. 

. 8 . 1 ‘ . o llnii j J L M!»iI . 

dince HATl. dot'o not tt'ot the r.trnctnral tltnaniic environmental elli'ctn 
on nenooro but dot'O oimiilato Ptrnctiiral dvnamie conpliny, Into the flly,ht 
ctnUrol aenr.or aiynala the Navi)',ation Bant' io nirmlated v^ith a opecial 
mounting provinion for the IMP. The Navigation Ham* nroviden a riy.id 
nioimtiny for the three lMt’'o and tht* two Btar Trackero, included in the 
Orbiter lOd-and-on vt'hicleo, when'hv precioion alinnuu'tiL of theoe critical 
nav’iyation device.'? may be maintained throughout Orbital flight. 

^>.8.d.T.5 Backup Flisdit ('.ontrol Byntem (RFCS’) 

The 0-meter and attitude indiciitor are oimulated and it io not a BAIi 
objective to teoi thin equipment, The SAII,, hov;ever, doeo need theoe 
function.o riipre.nented in the ay.nt.em for the noceo.oarv oy.'jtem l>*vel 
f unc t i ona 1 evalu;« t ionn . 

'j . 8 . d . Flinht Harne.n.n 

There are a number of differences bett;een flight and ,8ATL t'lei- 
trical cabling or harneasos. These involve interfaces ?A?ith .simulated 
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non-avionicG equipment and DPI onsBls^ioriK since EMI toptinp, is I'./t a 
SAIL objective. **>hile SAIL uses siusle point ground due to lack of 
vehicle structure, the flight hardware uses ehv vehicle structure as 
ground. Tlxe interfaces with the dynamic motion simulator require non- 
standard harness to mount the IMU and other equipment, 

5.8.4 Tlx e Test Program for OV-101 and ALT 

The avionics verification program is now taking shape. Tlxe con- 
cept for the Approach and Landing Test Project (Orbitur 101) is shown 
schematically in Figure 5-8. Tlxe relative working relationships be- 
tween the SAIL, ADL, etc. are readily seen here. Additional infor- 
mation concerning the SAIL system tests can be found in the following 
documents ; 

a. SD75-SH-0079 "integration and Preflight Tests" (System 
Integration) . 

b. SD75-SH-0080 "Preflight, Taxi, Take-off, and Climb" (ALT 
Captive Tests). 

c. SD75-SH-0081 "Cruise Mission Phase" (ALT). 

d. SD75-SH-0082 "Separation Sequence/Mated Flight (ALT). 

e. SD75-SH-0083 "Descent, Landing, and Post-Flight Taxi- 
Mated Flight Phase". 

The factory checkout and integrated test programs at Palmdale 
for Orbiter 101 is scheduled between March and November 1976. It has 
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t lu' 1 ollowi np. v'h U'l't Ivv'H : 


a, Vj'i liv mamUiiv t lu'iuj' .imu'mblv oim'v.u hm» by doimm" 
{itr.uJn!', Oi’biU'i’ tutlnivtuom p»'rlori>-aiu*i' lo I'uy.imn'iuir. Uv'Diy.ii v«hhuv»''* 
«u‘ut ti and iuibnyfU om and vombhu’d tmbavaU'w lum J ionrtl I'.ului. 

b, iH'maufU vat o uuu't ional iutnnrlty o* til tvitu-nw whon 
\){'«'i’ai i*kl in vaviovif! ili^bi luavloa aiul aoli'i'tk'd bacbni’, Vkdnndant » anil 
abort inoib'ti aa woll aa vt'riivinn ini va"SV!a owa • oinyMi ibiliiy and 
oloi't roinay.m'l i i' I'ompal abi lily oi .anbovat oma. 

’’ • !■ ’J I'yjL ^ X'^iL J a Snp noft AvUmii a ,\>jj vl 1 iaa 

1 r l.aKiratory Jji:?! !’! ) 

rhia lability at dtU* ia to In* naod un dovolopuu'iit toala, oiul- 
tO“ond I'ompat ibi lit V toata, and in't-iomatua* voi >. t xoat ion ol t'tu' Sluit t lo 
apaoo oommunioat iona and traokiny, avatom. It ta lo haw' au Intoi iavi' 
with !!AU, by both Rl' and hvtrdwaro. ymppori ol tin- proy.ram la o\piH'tod 
to I'onin with tlu* orbital illy.ht loai phaao. 

Major itoma oompriainy, tlu* training aiiuulator projv'ota iiuludo 
tho lollowlny, : 

a. Mhnt t lo Miaaion ;iiniulaior - dolivorioa aoUovlnlod loi 
Spriny. and iUiimnor ol Id/d, 

b. jdmttlo Miaaion Himulalor fompntor I'omplox - dolivorv 


1 


ol ihi' har»lwai’t>/ool twaiv ia t'xpt'cUsl in Sunmicr ol 1071'. 

0 . Orbit t'v Aorolli^bt Simulator - Oolivory la onpoclovl 
in SopCombor 197b. 

il. SUuCtlo Prooodui’oa .Simulator - it ia an in~houao dovolop- 
maul at .ISO and currently in uac there. 

e. t'rew Procedurea Kvaluator Simvilator - it is also an in- 
house development at .ISO and ia in use there. 

J. llie Shuttle rraininy. Airerail (STA) - two aireralt have 
been built to simulate the living qualities and trajectories ol the 
Shuttle Orbiter. These airoxMit an' to be used to train the Shuttle 
pilots by duplicating, in so lar as practical, the handling, charac'er- 
iatics atid visual cues expected to be experieixce.l in 1 lyinp, the Shuttle 
Orbiter in the Terminal Area bandinp. Trajectory. 

The manap.eraent systems tor the simulation activities enumatea irom 
the Operations Intep.rat ioix 01 lice at Level II at ,TS0. The manay.emeut 
scheme is shown in I''iy,ure ‘'-9. Ii\ avldition there is a Space Shut t li> 
I'roy.ram Simulation Planninj^ Panel established by Program Pirective lA, 
dated Hiy PI, 1974 which is to provide the mechanism lor accomplish- 
iiX}' coordination, planning, and review ol simulation activities. 

• 10 Avionic s ^kma.ecment 

The Panel in examining this broad area spent some time in umier- 
atandiixp, the hardware, soltware, lacilities and test prop, rams asso- 


123 


v'iaioil with tUo *\vlouic!? pvvi}U’'i«v. The I'anel iwitw'vl the otY.ani.-.u ion!'. 
in ejvLrttinu'i' which maua>’c« ihc avionics work: t,11i Orhiter avionics 

systems ollice at Project level 111, Technical Assistant aiU his di« 
vision coveriii}! avionics in the enc.ineerinj* dircctorat e, (1) data 
systems and analysis directorate, Integration and cheek-and-ha lance 
lunctions including, the intej'rai ion ollice at the prop.x'am level; such 
technical panels as the Intep.rated Avionics Steering, viroup, the SIR and 
OSIR and associated Panola; hardware and sotiwarc coniip.uratlon/channe 
contx'ol hoards; aixd the technical review process includinp, system de- 
siftn reviews on each mission phase. The lollowiny, sections indicate 
some ol inanajtemenl ' s actions to assure eltective manap.ement ol avionics 
development . 

. 1 0 . 1 l 1xc Program Mmay.ement Panel .System lo r Avionics 

lUaed on the Prop.ram Pirective settinc, vip the .‘tpace Shuttle Inte- 
p.rated Avivuiics Technical Mmapement Ai'ca, the tollv'winp, respvuxsihilit ies 
are juven to the Rystema Knp.ineerinc. Ollice vU level Ii; 

a. Assessmt'iU ol the technical adequacy oi the overall per- 
tonnance ol avionics systems lor the Space Shuttle vehicle within the 
avai lahle resources . 

h. I'oordinat ivw, publication, and implemcntat ion oi a plan, 
including, task del ini lions and sehcxlnles, lor the acevMiiplishment ot 
the technical manap,or'.s responsibilii ies ineludiny. establishment ol 


the mombeirnhip o£ the intop, rated avionics paitols. 

c. Manupement of the activities of the integrated avUmics 
paitels to assure adequate conununications and understandiitp, between 
all personnel involved as well as program nutnapcmeitt. Membership 
on the Systems Integration Review (SIR) panel which supports inte- 
gration activities across the program. 

Tour panels and a steering group were, established as follows; 

a. The Integrated Avionics Steering Group which brings 
together avionics management personnel from vTSG, MSFO, KSC, and Rock- 
well Space Division. 

b. The Shuttle Avionics Panel which serves as a technical 
planning, reviewing, and integration team for all .Shuttle avionics 
interfaces. Tlteir work includes conceptual studies, system analysis 
and syntheses, trade studies, preliminary design, and supporting 
technology essential for the specification of the functional .and 
pertonnance requirements of the integrated avionics systems. 

c. The Flight Communications Panel which Insures the com- 
patibility, performance, and timely definition ot ccnmiunications 
and tracking system interfaces and identifies problems, detemines 
corrective action, ai\d recommends appropriate action to the technical 
m.anager. 

d. Tlie Shuttle Avionics Checkout Pani'l which serves as a 
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lorum lor tlu‘ Inloj’vation vil tlu> avionicH diookom aiui pivlaum'U 
t*'fUin}', I’l'quiivmont 8 lor thi' olomouts oi tho ^*huttlo «y:ilom. Ilu'ir 
xi?ork vv’tvtn’H iwiow ol rcquii'i'mi'nl a, ti'st prociHluroo, avlonii*a loiu 
ooitwaro voqvilromont a, aiul tho I’onolution oi avlouico oluH'kvnit iaam'r. 
iv>x- laoloi'v ohockout ai PalmUalo, AM’ pro- ami poHt -i lip.Ut chockout , 
ihookout aiul maint onam-o tontinp, at KSC, ami .support ol pro- ami poat 
ilip.ht olu'okout lor tho oporai ional phaoo ol tho prop, ram. 

0 . Tlio Shut l lo Avionics Voriiioatiou Pauol whicqj sorvos 
as a special workinp proup lor planninp ami coordimuinp thi' tost 
activitios ol JSC, K.St!, MSl’t’, ami Rockwell. 

'> . 10 . .! Special Requirements Review.s 

Minapement has iocused a preat vloal ol attentioxi on the hardware 
lo-soltware compatibility aspect. s oi the avionics systems at every 
level oi the propram and at every major step in the schedule. I'or 
instance there have been a number oi special reviews ol soltwai’c re- 
quirements ior the ALT and the OIT phases oi the Shuttle pi'opram. 
Tlu'se have been termed "scrub" activities and they arc planned as a 
continuinp activities to astnire re<iuirements are well de lined .iml can 
be met. The methodolopy used in these activities penerally lollows 
these lines: 

a. Review the approach and the results oi previous sci'ub 
activities alonp with the most current hardware coni ipurations and 
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porfornumce requirominits , 


b. Kntablish the Roals and basic capability rcquiromeuts 
to bo used as decision criteria. 

c. Conduct reviews with pertinent nunap.ero and key tech- 
nical personnel to assure a common undorstaitdinp, ol the scrub f'rovuul- 
rules and expectations, assess so it ware module lunctional content iv- 
quirements and ap.ree on possible deletiors with their impact. 

‘1. Finali.’.e the specit'ic requirements modii ications, de- 
letion and additions as options to be prv>posed to manap,emeut. Par- 
ticular attention is p.iven to assure they have not reduced the cap- 
ability to protect ap.ainst software p.eneric failures and the like. 

e. Present the options to manap.eraent lor their decision 
alonp, with the backup nuiterial vipon which decisions can be made. 

‘) . 10 . ) ProRram Activities 

In response to the Panel's reviews of avionics hardware/sof twax'e 
the following areas are receiving special management attention: 

a. Management is sensitive to the fact that establishing 
minimum levels of testing on which to base a flight vv’orthiness de- 
cision is a difficult judj^ent. The avionics system, of course, 
must work because it is not tolerant of generic failures in the 
software. 
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b. >Lnnageiaent has cstabliGhcil teamt) to review the recivilre*= 
meni!? and aaoeoB the impact oi' any ehangea su>’.t’i't!ted. Tlie team approach 
in equivalent in purpose to the System Design Requirements Reviews. A 
team has JSC, Itockwell Internation Space Division and IBM member!’. . 
nie membership reflects the projects new approach on integrating Rock- 
well and IBM operations more closely v>n a day-to-day basis so potential 
problems can be worked out early. 

e. The IBM schedule is tight end initial verification re- 
quirements are being reassessed. However, nwnagement is looking to 
the BAIL lest programs to provide a more comprehensive validation 
of iVte software as a supplement to the IBM efforts. 

d. ftmagement is carefully controlling new requirements 
after the .software requirements are authorised at the System IK'sign 
Requirements Reviews. Currently oitly numilatory changes are appri)ved. 

e. Because of recent scrubs the software requirement!', for 
ALT are currently within the cap.acity of the memory. 

f. The verification schovlule lor ALT i.s tight. The I.evel I 
milestone of completing the AI.T flight software verification has been 
changed from .July 197b to November 1976. Management is now planning, 
its I'osponse to this .situation. 
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p,. Plans are beinp made to validate late modiiieatioi* i lo 
the software in the SAIL facility, but if these mods are much greater 
than planned for, there will be a schedule problem at that time. 

ATOUN hUM 

The computer program end items (CPLl’s) provide, the capability for 
checkout of the Orbiter avionics sub8yst.'.ms at the factory perform 
the required preflipht and flight operations, Thi' basic proprams 
associated with ALT and the Orbiter 101 of direct interest to the Panel 
are; 

a. OPS 8 and OPS 9 Systems Manapement 

b. OPS 1 - Preflipht Checkout 

c. OPS 2 - Fllpht Operations 

The requirements for OPS 1 and OPS 2 have been scrubbed to brinp 
them well within the storage capability and processing rates (time to 
process') of the general purpose computer. The ri'sults of the latest 
scrub actions and an ide.a of available margins is shown below: 

ALT (Orbiter 101) OPS 1 OPS 2 

Before scrub 64,060 wds 107.0“/, rate 67,270 wds 91. 7, > rat.> 

After scrub 52,880 wds 57.27, rate 54,190 wds 66. 47 rate 

Current schedules have the software programs for tailcone off ALT 
operations to be completed first although such flights come last. Thi*n 
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throuj’.U parameter ehanp,o« tiu» ALT taiU'ono on ooftwaro proprams v;ill 
bo oompletod. This, hovjovor, noeossitatos tho vi'rif leal ion and final 
ehockont of tho "ON" Goftwaro ro bo accompl ishod lafo in tho program 
at DFRC.vory eloso to flight time. 

'■) . 1 1 . 2 OFT Pro loot 

Tlu* software prop, ram roquirements lor the nscent and entry phases have 
been oerubbed with the ftllowinp, resnlto; 

OFT (Orbit(‘,r 102.) Ascent Software Fntry S oftv;art' 

Kotiuuted Current Sine ‘lb, 900 words 52,AOO vjocds 

Hstimated Additional 700-800 ')00-(>00 

words to be added as 
known today 

I’rogram manapemert is using the le.nsons learned in developing the 

ALT software to enhance the OFT soft'.'are development program. As a 

result a more detailed OFT work plan to assure adeq-ate and timely 

daily direction, visibility and control is being established. For 

example "Mode Teams" have been established to define, integrate and 

simplify software requirements and to work problems as they .arise. 

Hixteen such teams have been or will be established to cover evei*y major 

aspect of the. mission phases. The first meetings of some of these 

teams was conducted during the last week of May 1976 at the RT/.Space 
Division. 

9.11.1 Further Actions 

Program management has also instituted wet'kly telecons between 
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JSC, Fwl/Downey, Rl/Palm<Ialo to rovltiw statue and pronross on flu‘ 
avionics checkout beinp conducted on Orbitei* 101. 

A permanent scrub group is to be formed soon to assure that 
all requirements laid on avionics software and hardware will be 
compatible and that there will be sufficient margins to accommodate 
the growth in requirements as the OFT mission matures. 
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ATTAClC-HiOT 5-1 


Tlu* inanaqomont oystom for avionic hardware and noftv/aja* 
fihould be reviewed by oenior proqram manaM'onent to asauro 
It in adequate for the indicrted coroplexiiy of the pr«>(jram. 


R.'sponne: The avi onion manaqi nirnt ..nd tlevelopmeiH plan Ir. con- 

!:i'lejed"a critical element of lfu> fUace Shuttle Proqram, In 
iiajiuary of Ihin ve.tr the avion icn and l’li<iht c(ailinl ntatufi wan 
leviewed at the proqram dinudor and Diretdor (d MJtr level:;, 'i'hc 
ai'can of coortlination of the haj (tware/nol Iware 1« ohnlcal w’otl. .md 
the d(‘qreo of the (contractor ro,*;? onnibi li t y wen' idt'ntified, amona 
otherr*/ an nuiuirinq turt.her man sqement .ittiaition. The laici.vell 
renponnibil i ty in avi‘>nics ha;; been clarified .uul ;Jtr(*nqth< nod by 
emphanizinq their area;; of re.nponnibili t y and objedtiven. .''pocifio 
adiuntmentn have been made, hr. an examole, they hav(» been n‘- 
qurT.ted to inelude tlie overall computer memory and operat.ion;; duty 
cyolc' est imaten and refjulrinq l h(*m to e.ntablinh bodi(*o for oaeli 
of the proqram elemt'nlfi of the noftware 'a.nidonl in blu» onb‘>.ud 
computer. They have been requirced to pj»*pare a e<^nt effect ivi' 
overall avionics development plan utilizinq enqinoorinq .nil iUlatlon:. 
at RI and NASA ADL# SDL, and SAIL facilities to .support 101 and 
102 .nchedule.n. 


A review of the total flight control area wan conducted and a 
ijinqle individual was identifit'd as havi nq total flitjht control 
responsibility for both Level XT and Level TIT for the Space 
Shut.tle Proqram. Hc' prepared .i total reviev/ of the status of 
fliqht control design, requirements, managi'monl , and required 
resources, together with a flight control dovelop’nent plan. This 
rc'view and {>lan were presented to the center director who .ipproved 
the plan in June of this year. 

The Space Shuttle Orbiter Project Office avion! c.n effort ha;; 
strengthened by clarifying responsibilitiG.n and Ir/ adding por;;onne] 
A weekly avionics system review working meeting has been e.stabl i ;;h<' 
with the RI Associate Engineering Director of Avionics, the .softv.'ar 
contract manager, the NASA avionics systems engint'ering manager, 
and chaired by the Space Shuttle Project Office avionics manager. 
The avionics manager reviewed the center plans for integrating the 
avionics effort with the Space Shuttle Program Director and the 
Associate Administrator for Space Flight in June. 

A single individual has been identified and established by appro- 
priate directives as the focal point for all Space Shuttle avionics 
engineering. At this point. Level III and Level II hardware; and 
software responsibilities are combined. The chief of avionics 
engineering and the Space Shuttle Project avionics manager are 
preparing an overall avionics development plan and a management 
plan to be presented to the Space Shuttle Pi- jram Director and 
the Associate Administrator for Space Flight on September 29. 
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SIMULATOR OPERATIONS AND MANAGEMENT PROCEDURES 



142 



6.0 RISK MANAOKMliNT 


6.1 Iiitroduction 

Tlie iirst captive flight of the Orbitex io ccheduled for the 
firot quarter of 1977 and the first free flight of the Orbiter is 
scheduled for the third quarter of 1977. Tliese significant mile- 
stones indicate the importance of an adequate risk management pro- 
gram in support of knowledgeable flight readiness decision makiiig 
by management. 

At the top level of review the risk management program asks the 
basic question, "Is the sum total of all of the accepted risks, that, 
is the aggregate risk, commensurate with the benefits to be sought 
(e.g., first captive flight)?" Tlie terra aggregate risk is used in 
the sense that it is the synergistic total of the individual risks 
accepted by management on a one-by-one basis, ‘Hie question of whether 
the aggregate risk is acceptable is a matter of judgment and is the 
prerogative of line management who must have both the autonomy and 
responsibility for such a decision. The Panel's purpose is to re- 
view the management system and assess whether it has the capability 
to do the job. To do this the Panel covered the following areas to 
obtain an integrated overview of the risk management system. 

a. The current safety system for Che identification of 
hazards, tracking hazards, analyzing them for resolution, risk 
assessment and acceptance procedures, and aggregate risk analysis. 
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b. Tlie products resulting; from the above activities and hov; 
they are used vrithin the pro).»ratn, by upper levels of manay,eincnt and 
others responsible for the oversight of the Shuttle program. 

c. Tlic managemeiit system and its implementation to assure 
the appropriate use oi, "lesoons-learned" from prior programs. 

d. Tlie "check-and-balauee" system to preclude items "fall- 
ing in the crack" including the role and work of the Grew Safety 
Panel and the nev/ technical assessment g, roups. 

e. The ability of those revicv^ system elements of the 
management, such as configuration control boards and technical re- 
views, to assure that individuals throughout the program can raise 
responsible safety concerns. 

f. 'Hie role of the Cost Limit Review Ik»ard in reviewing 
safety issues. 

g. Tlie ability of the review system to assure safety 
coverage of technical items while providing risk infomuition to 
management. Some of the specific questions asked in the Panel's 
review of these areas include: 

(1) Tlie controlled use of Teflon in areas with po- 
tential ignition sources. 

(2) Tlie library and control system for tracking and 
understanding the use of non-metal materials. 
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O) Reliability ami Quality Aanuraneo nuHhoilo to 
aoourc that faotenero meet deoii^i requiremento lot their application. 

(4) Tlio controls to preclude wire bi*eaka|»e tjliere tlie 
wire is subject to repeated handlinfj and/or substantial vibivation. 
Special attention was ^^iven to the use oi 26 AVR; copper wire because 
ol prior Apollo esperience on the Lunar >fc»dulo development Rlight 
Instrumentation system. 

(5) Tlie system for tollow-up and closure ol Ueviev; 

Item Dispositions (RID's) resulting from hardware and software re- 
views and panel operations. 

(6) Tl\e extent of analysis accorded to critical single- 
point failure items such as Orbiter eleven actuators, thrust vector 
controls, fluid manifolds, and so on. 

(7) Tlie adequacy of the landing g,ear deployment system 

on the orbiter. 

(8) Adequacy of the many door systems on the Orbiter 
to open and close as required. 

(9) 'file control of "numdatory" prog, ram items, require- 
ments, tests, etc. to assure there is adequate management attention 
when they are revised because of changing resource and schedule 
constraints. 

>kmy aspects of hazards identification and risk assessment have 
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bt'on in otlu'r ooctiono ol ihio report, 'iliiu ii; pari IcularXv 

true eoncernini' "leoooiw learnea" ami their olf'uilieauoi' tor oaiety 
oi the deoii'.n loot ami raalnienance aetivitieo on the 131518;, Arbiter Tl'i> 
and ooit'jare, KT inoulaeion and SRB. Hiio oection, therelore, doalo 
v;ilh the oaiety, reliabiliyy and quality aoouranee r>yotewa; how they 
are Implomeuted; and typical eKamplco of opociiie items to dcmonotrate 
theoe oyotemn and to anDv;cr opeeiiic concorno raioed by the i\inel and 
NABA management during, the past: year. 

Very little attention has been given by the Panel to the Shut tJe“Pay load 

£ 

inter face and the assoeiated safety implications because this is an 
area that will have to be covered at a later time, 

o.g Responses to Panel's Previous Annual Report 

Almost all of the material contained in the Shuttle Program 
t)Uice response to the Panel's Annual Report had some bearing on the 
safety aspects of the program. Ihese responses, though have been 
distributed among the sections of this report as a part of ittdividual 
1 ‘lemont responses. However, one area is included here as Attachment 
d-1 because of its broad scope. 

() . 5 Tlie Risk Management System and its Implementat ion 

As v-'ould be expected the so-called risk manag.emeul system is in 
reality mdo ixp of a number of on-going, activities at various levels 
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01 tlu' proiU’on and nt variouo local iono an well an thooc c h>rt a ruidc 
by the ilodicatcd reliability, oafety and quality aoouranc»‘ ory.anii.aUon! 
and pcroonnol lound throuj^hout; the Shuttle pvoi 5 ram. I'ltirMtcly the 
declcionc renardiny, rink neecptance lien v;ith the project .ind proy.x’aiu 
numayern v/ithin NASA Centero and UeadquarterD. IJliile it in an accepted 
Tact that "oafety io everybody* o bucluenn," one luun' lirot look at the 
nyotem dedicated by nasne and job deocriptlon to the reliability, oaii » 
ty and quality aoourance diociplineo and then look at the many Ions',- 
term and day-to-day activitieo that feed and are footered by thin 
central core of riok numayement activity, 

Itathcr than approachiny thio oubjeet from the academic point oi 
view it haa been approached from the "real-lile" vievi. In doiiij’, 
tlil's, riok nuanagemont as it applies to the Approach anti Lamlins', Test 
project and the early DlXCfciE Minned t»rbital Pliy,hto has been tlte sub- 
ject of the Panel's OKamination. llie basic Panel tiueotions are "Hoiv’ 
does the system really work and what are the products of such activitie; 

0.3,1? Approach and I.andinp, Tost Prolect (ALT) 

0 . 3 . 1’ . 1 Rackyround 

'file responsibility for deciding the acceptable degree ot risk 
associated xi?ith the AI<T flights is generally viewed as the vy.t. lusive 
province of senior management. From this standpoint, management 
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loouoL'o on balancinf? rick npalnoL bonoflco on a maero-ccalo, bat dovm 
the line innumerable riok-benefit, nviero-dceioiono are quite naturtilly 
nado without rceouroc to higher manai'emcnt. However, prior esperieiuH' 
hao ohovm that oomo of theoe are i’ecor,ni;’ed to be of miijor oicnilicanet' 
when their el fee to become vioible., .qometimeo it io too late for 
corrective action or it io late enou};h that corrective action lo 
cootly. Tlierefore, the Panel hao attempted to reviev; each type of NASA and 
contractor rioU acoeooment activity v^liere the purpooc of theoe effort o 
io to v;arn the program of the poooibility of problemo; the resoureeo 
and time required to reoolve the problem; or the implicatlono of 
accepting the problem, 'fliio review includoo such questions as super= 
vision factoring "leooono learned" into their work - are teot planners 
and toot conductoro aware of safety concerno relating to the hardv/are 
they are to teot and to fly. background on the ALT project Itoelf 
io found in Section 8.0, "Flight Teot Program." 

6 . 3 . 2 . 2 Safety Asoeosment 

Tlio Space Shuttle har.ard identification and resolution oyotem hao been 
well defined for scope of the Orbitor 101, the Boeing 747 Carrier 
Aircraft and the supporting facilities and operations for the ALT project 
risk management system includes hazard identif ication, failure mode and 
effects analyses, risk 'nalysis beyond initial FFffiA, hazard resolution, 
risk acceptance criteria, and ultimately the decision to accept or 
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reject the risk. So on« muoL review both the dvtlncd mcth>dolo,.y as 
well as the daylo-dsy Input which toKether produce the final risk 
assessment. In regard to the ALT project JSC and Rockwell arc the 
primary managers with direct support from DFRC, Ames Research Center, 
Hoeing Company, KSC and the JSC support contractor (MUAC). Ttie follow* 
Ing areas were sampled as being representative of the overall safety 
assessment /risk nuinagcment "system." 

b. 1.2. 2.1 Approach and Landing Test Critical Healgn Review (CDR) 

'Ute ALT/CDR was conducted during the period from FVirch 11 to 
April 22, 197b. ^V^ny of the RlD's and detailed discussions and de- 
cisions involved hazard Identification and assessment of the overall 
safety system. This Is, of course, a normal part of any major hardware/ 
software review. In addition to this ALT/CDR, two other significant 
reviews were conducted on the Shuttle Orblter 101 vehicle and they are 
Important elements of the Alt safety assessment system. Hie Orblter 
101 CDR was conducted in October 1975 and the Orblter 101 Configuration 
Review (rtiase I) was conducted from February 23 through March 5, I97b. 
Because of their Importance for safety all three of these reviews are 
discussed here from this point of view. 

In support of the Orbiter 101 Rockwell provided a seven volume 
"Safety Analysis Report," SD75-SH-0135-001 through 007, dated 15 Sep- 
tember 1975. These volumes covered six specific topics; (1) struc- 
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lures, mechanical ayatema, power ayatema, avlonlca ayatema, environ- 
ment control and life support, crew statelon and equlpmiMU. In 
addition a aunmuiry volumt' for management was Included with a copy 
of the detailed Rockwell ••Reliability and Safety IX»ak Instruction 
No. 400-l*^ therein. Other documi'nta used In the review Include the 


following: 

SD74-SH-0004 

SD74-SH-0168 
SD74-SH-0323 
SD75-SH-0064 
NASA NHH 5300.4 


Shuttle Orblter Ni>. I Horizontal Flight 
Teat SAR 

Shuttle Orblter 101 IX ita PDR SAR 
Shuttle Orblter 102 PDR SAR 
Shuttle System PDR SAR 
(lIVl) 


The review team also considered the ••Failure Mode and Effects 
Analysis and Critical Item List,** t Ina* /cycle /age life control Hats 
and requirements; FEE parts use and qualifications; specifications 
and procedures for identifying and controlling speciil processes and 
more specifically all pressure vessels; conf Igurat Ion control system, 
specifications and handling ot suppliers and subcontractors; failure reporting 
system and its implementat ion^ etc. The following review team comments 
Indicate areas that needed work and the program response to them: 

FMF.A/CIL Suggested revisions to the hardware 

failure mode analysis regarding mode de- 
tection measureiTH*nt 8 and modification 
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of mode effect. All comnonts luiv * bocn 
Incorporated Into the FMIUV ayatem and 
docuim*ntat ion. 

EFE Parts Required Rockwt^ll to obtain sufficient 

documentation from suppliers such as 
parts llsts^ stress analysis, anJ sub- 
mission of Irregular parts requests to JSC. 

Safety Analysis Requested additional hazard analysis on 

the loss ot Bi)dy Flap Control as well as 
updates and clarifications all of which 
have been accomplished. 

Test Programs Required that certification plans to 

Identify those items of hardware to be 
used In development tests and in quali- 
fication tests. Assured that SR&cjA per- 
sonnel would be on the control board for 
such tests as the Horizontal Ground Vi- 
bration Test. 

A typical RID concerned the mechanical system in which the 
commander and pilot control pedals are linked together so that Jam- 
ming of either station by debris can prevent operation of all pedal 
mechanisms. This safety concern was resolved by providing a protective 
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boot for all affected linkages. Another RID covered the relocation 
of the Hazardous Environment Breathing System mask equipment to 
assure the crew quick access to breathing air. lliese were relocated 
from the mid-deck position to the flight deck position. 

With regard to electromagnetic compatibility of the hardware 
the Orbiter was baselined with a single point ground for the AC 
power and a modified multi-point ground for the DC power. Ttie for- 
ward bay avionics has a DC power ground at station 76. Hie aft avionics 
bag has a DC power ground at station 1307. Some loads in the nose and 
aft fuselage are grounded to the structure. The use of a structure 
return for the DC loads in the AIT fuselage area saved weight. Structe/ee 
power grounding is used on many aircraft currently in service. A 
specification is being developed that identifies the various EMI levels, 
and the power quality environment for the Payload bay. Special EMI 
testing will be conducted during the Shuttle development program to 
verify this environment as has been done on previous programs, in- 
cluding a comprehensive test of the Orbiter* s electronuignet ic environ- 
ment and lightning protection on Orbiter 102 at Palmdale Assembly 
Facility in late Spring 1978. 

Hie purpose of the Phase 1 Orbiter Configuration and Acceptance 
Review was to assess and certify the readiness of the Orbiter 101 sub- 
systems and related GSE for individual subsystem testing. An important 
part of this review was the NASA walk-through conducted at Palmdale 
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to asteta condition of the vehicle. The walk*throuKh team ton* 
eluded that the hardware waa very good and the peraonnel aaalgned 
to It were doing an outatanding job. The Phaae II portion of Ihla 
review concerned itaelf with the readineaa of the Palmdale facility 
aa contrasted to the readineaa of the hardware aubayatema. 

An intereating RID from the CARR pointed to the hazard of 
shatterable materiala In the Orblter cabin. Aa a result, atepa have 
been taken to reaolve this iaaue by (1) compiling a complete Hat of 
all ahatterablc materiala contained In the Orbiter 101 crew compart- 
ment, (2) performing a atudy to determine how ahatterable glaaa can 
be protected ao that It la contained if broken, and (3) determining 
if any of the Itema uaed In Orbiter 101 for A1,T have found their way 
into Orbiter 102, and If ao to assure an nasesament of the hazard. 
When thla data la In for management review, a decision will be nvidc 
at a CCB meeting. 

IXirther information on the Orbiter 101 CAR la found In SSV76-5-3 
document dated 4 March 197b. 

the Approach and Landing CDR conducted in April waa followed by 
a Shuttle Carrier Aircraft (747) CDR in May 197b. Some Items per- 
taining to the safety area that were brought out in thla review are* 
a. Prior to each SCA/Orbiter flight, a Flight Readiness 
Review will be conducted and supported by all elements of the ALT 
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project including the Kockwell/Boelng flight safety support personnel. 
When the ALT Project Safety Plan is finalized this suport should be 
defined. 

b. The following documents are in process: (1) safety 
plans for the ALT site, (2) safety plans for 747 test operations, 
and (3) safety controls for 747/Orbiter Mating and Demating. 

c. As a result of a RID in the October 1975 CDR^ an 
Orbiter 101 Delta CDR was conducted for the Separation Subsystem be- 
tween Orbiter and 747. As a result of the Delta CDK the Orbiter ALT 
program verification plan (Ml:r 2031) is now in work and will include 
verification plans for end-to-end checkout of the separation system. 
This plan is to be available for NASA review about June 30, I97b. 

6.3. 2.2.2 ALT Mission Safety Assessment Docuraent (JSC-10888) 

This document defines the results of the total safety analysis 
and risk management process. It identifies operational hazards that 
could compromise crew safety or damage the vehicles involved, 
evaluates risks for each operational hazard, provides an overall 
assessment of the ALT mission with respect to crew safety, and de- 
scribes the status and actions necessary to ”close** identified 
safety concerns. TTiis becomes a major input to the Flight Readiness 
Review system. 

Tlie closed-loop methodology used to fulfill the requirements of 
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a Mlaalon Level Hazard Analyala and the finalizinK of the Miaalou Safety 


Aaseaament Document it shown schematically in Figure h-1. The schedule 
for the ALT Mission Safety Assessment Report currently is: 

Initial Document Release June 1976 

Final Document Release February 1977 

Up-Date Addendum (captive flight) March 1977 
Addendum for Free Plight July 1977 

Up-Date Addendum (free flight) July 1977 


6.3.3 Safety. Reliability and Quality Assurance for Ground Test 
and Orbital DDT&E and Operational Missions 

6. 3. 3.1 Malor Safety Concerns 

There has been a need for a simple but useful means of providing 
program and senior NASA management sufficient visibility of Space 
Shuttle safety concerns, the means of resolution and the major accepted 
risks. This need is now being met by the "Major Safety Concerns Space 
Shuttle Program," (jSC 09990). This document is updated quarterly 
to reflect changes in status of major safety concerns and to add newly 
selected items. The latest issue available to the Patel, dated March 8, 
1976 showed the following count : 


Open safety concerns 

19 

Closed safety concerns 

16 

Accepted risks 

7 
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Table 6-2 shows the listing of open safety concerns, closed 
safety concerns, accepted risks, and those design features that repre- 
sent Inherent risks which are considered to be Justified. The details, 
of course, are contained in the referenced document. 

This data enables the Panel to evaluate the process for deter- 
mining which concerns are significant enough to place in this documeti 
for management. The Panel has also indicated a continuing interest 
in all of this data because some continuing interest in all of this 
data because some safety concerns that have been closed or accepted 
may change in "value" due to other programmatic changes which impact 
them. 


6 . 3 . 3 • 2 Content of Level II S, R&QA Activity 

The work conducted at the Space Shuttle Program Management level 
(Level 2) at JSC is quite diversified. Table 6-1 lists some of the 
products of this work that have or will be published for information, 
analysis and control of various phases of the program from ground test 
through flight test and operational missions. 

Some of the formalized plans such as the POGO Prevention Plan, 

JSC 08130 and the Contamination Control Plan, JSC 08131 play an 
Important role in developing successful hardware that meets the re- 
quirements of the program specifications at Level I, II and III. 

The materials control program, "MATCO," has been an ongoing pro- 
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gram since the early days of the Shuttle Program. Ihe contents of the 
program are constantly being updated to assure timely and complete data 
to support all levels of the program at all affected NASA Centers and 
contractors. Some of the requirements documents that apply directly 
to this work are: 

Level I (NASA Headquarters), NHB8060.1A, "Flammability, 

Odor, and Offgassing Requirements and Test Procedures for Materials 
in Environments that Support Combustion." This is also applicable 
to those payloads that are placed in the Orbiter habitable areas. 

Level II (JSC) SE-R-0006A, "NASA- JSC Requirements For 
Materials and Processes." 

Level III (MSFC) MSFC-STD-506 "MSFC-NASA Standard Materials 
and Process Control." 

Level III (KSC) - Document is not known by the Panel. 

Rockwell International, SD72-SH-0172, "Space Shuttle Orbiter 
Materials Control and Verification Plan." 

Rockwell International, MC999-0096D, "Materials and Processes 
Control and Verification System for Space Shuttle Program." 

The Panel has reviewed some of the MATCO program and it will con- 
tinue to review this area to assure that the methods for implementation 
are adequate to Che program needs. In using MATCO information to 
evaluate materials actually used on the Shuttle, the program must have 
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an eCfacClve configuration control ayatem to aaaure chat the materlala 
evaluated in the deaign phaae or in fact uaed on the flight vehicle 
and any materlala aubaequently introduced into the program are alao 
carefully evaluated. Thua the periodic configuration control board 
activitiea examine the materlala problem for every change made to 
the hardware and deaign reviewa. 

Aa part of NASA* a continuing effort to eatabliah uniform and 
complete policy and reaponaibilitlea on areaa chat affect safety and 
miaaion aucceaa Headquarter ' a haa iaaued a Management Inatruction on 
NMI 1710.3, dated April 8, 1976, "Deaign, InapecCion, and Certification 
of Preaaure Veaaela and Preaaurized Systems." 

Attachment 6>2 is a letter coveting the potential problems asso- 
ciated with nuclear detonations. It is indicative of some of the 
areas of safety examined by the Panel to assure program attention to 
as many details as possible. 

Much of the material that follows is also a part of the work 
done in the safety, reliability and quality assurance efforts dis- 
cussed above. However, it is discussed separately because of the 
Panel's interests. 

6. 3. 3. 3 Flight Termination System 

The Flight and Ground System Specification (Volume X of JSC 07700) 
was revised April 12, 1976 (Change No. 30) so that the requirements for 
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range safety now reads as follows: 

"The Flight Termination System shall comply with the 
range safety Flight Termination System requirements of AFETRM 127-1 
and SAKTECM 127-1. Htc flight vehicle shall Ciwiply with the range 
safety requirements of SAMTECH 127.1. In those Instances where 
adherence Is Judged to be Inappropriate from either an operational 
or technical standpoint, such Instances shall be brought to the 
attention of the DOD/NASA for resolution." 

This guidance Is developed In greater detail for those sections 
of the document that deal with the specifics of mission abort oper- 
ations functions, flight system design on the SRB and ET Including 
destruct saflng. The current effort Is to baseline mutually acceptable 
concept for NASA/DOD Space Shuttle Range Safety and define the mode 
of resolution for problems that subsequently develop. The current 
hardware safety system Is called a "Triplex" system In that each SRB 
and the ET have destruct systems on-board. There Is sufficient re- 
dundancy to assure proper operation In either the armed mode or the 
safe mode. Items of Interest that will be examined by the Panel In 
the near future Include the following: the agreed-to baseline concept; 

current open problems regarding the design. Installation, and utili- 
zation of such a system; any schedule and procurement constraints; 
current design options and their advantages and disadvantages; and 
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constraints on oparatlonal and ODT&E missions. 


6. 3. 3.4 SRB Fracture Control Board 

Recognizing the importance of fracture control of SRB rcuseable 
components, HSFC established an SRB Fracture Control Board which 
held its first formal meeting on October 8, 1973. Ihe Board is set 
up as sho%m in Figure 6>2. This board has undertaken a number of con* 
current activities to assure both that every aspect of fracture con- 
trol for the SRB is properly accounted for and not information re* 
suiting from this effort is furnished to other Shuttle activltleH 
for their use. Each of the major contractors on the SRB have developed 
fracture control plans which are cither being implemented or in pro* 
cess of being implemented at this time. These plans provide for the 
following functions: 

a. Development of fracture control technical guidelines 
and directions. 

b. Establishment of a contractor Fracture Control Board. 

The Hoard reviews and approves all fracture analyses, fracture con- 
trol test data, and component control plans. Finally it monitors com- 
pliance, and establishes necessary corrective actions and reports. 

It reports to the NASA SRB Fracture Control Board and is also a 
major support for the ^iaterial Review Board. 

The MSFC board, in addition to working with the contractor units, 
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do«« its own indep«nd«nt «n«lysla and taatlnR and malntalna a dc* 
tailed Hat of "technical concerns and action itema" and aaaurea 
their resolution. 

6. 3. 3. 5 Abort Planning for Shuttle Flights 

Based on the material provided to the Panel during its reviews 
of the abort area sosa^ concerns have surfaced. These are in regard 
to the timeliness and depth of studies to define abort capabilities, 
and supporting the assessment of aggregate risk for any given mission. 
The Level I, II and III docuroentat ion sets forth requirements in the 
general area of aborts as well as specifics relating to intact abort, 
contingency aborts, and appropriate loss of critical iunctiona. Such 
abort analyses are directed primarily at the DDT&E and operational 
orbital missions, although such analyses apply to the ALT missions as 
well. Abort planning and activities associated with ALT are covered 
in Section 8, "Flight Test Program." 

In addition to the many efforts going on at both NASA Centers 
and the contractors a number of Level II panels and review teams have 
been examining this area in some detail. Some of these arc the Crew 
Safety Panel, the Systems Integration Review Teams, Flight Operations 
Pane, SRAQA Panel, Ascent Flight Systems Integration ('.roup, and the 
Abort Panel. 

The Level II specifications have specified the requirements for 
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Intact abort and the intact abort mo«'ea. Theae aamr tpcclf Ications 
have specified the requirements for contingency abort and the con* 
cingency abort criteria. However, the contingency abort biodcs have 
as yet not been defined. Attachment 6*1 is the Shuttle Program 
Office response to the Panel's previous Annual Report covering this 
particular area of concern. An area of concern to the Panel has been 
the abort capability during the early stages of ascent when the Solid 
Rocket Motors and the Orblter Main Engines arc all burning. 

The Level I requirement (JSC 07700, Voluote X) is that potential 
failures in a system that could cause loss of critical functions will 
be eliminated by including appropriate safety margins or redundancy 
levels in the design. In addition crew ejection seats will be pro* 
vided for the initial series of Shuttle OFT launches until the flight 
worthiness of the launch system has been demonstrated. These ejection 
seats as baselined for the orbital flight test program provide crew 
escape capability up to approximately 80,000 feet. Ute SRB thrust 
termination capability and the use of abort rockets were included in 
the early Shuttle baseline. However, they have been deleted by Level II 
action. The PCIn SOOOIS deleting the abort solid rocket motors was 
approved in 1972. The PCIN S00040 eliminated SRB thrust termination 
in 1973. 


6.3.4. Special Topics 
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6.3.4.1 Lestong Learned 


The Panel reviewed the management system to assure the approp- 
riate application of lessons learned from prior programs. 

The task team met with personnel at every level of JSC, KSC, 

MSFC, Rockwell, and Rocketdyne. They were supported by the efforts 
of the others who also focused on the application of lessons in areas 
under their review. The Panel as a whole then discussed the system 
as they found it with Shuttle management. 

Assurance that lessons are in fact being implemented is accom- 
plished through: 

a. Lessons are incorporated into such documents as design 
manuals, process specifications, etc. 

b. SR6cQA conduct audits to assure lessons are being imple- 
mented where proper to do so. 

c. Contractors* reports on their implementation of lessons 
at quarterly reviews and othe"* in-house meetings. 

d. Hie Aerospace Safety Advisory Panel reviews this area 
on a periodic basis at various NASA and contractor sites. 

Hie Panel is also interested in assuring that lessons learned 
on the current Shuttle program are examined and applied as appropriate 
here and now. Here is an example of how experience is captured, 
passed on, and finally utilized. This comes from the External Tank 
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data reviewed and discussed at MSFC In early Fall 1975. The Martin- 
Marietta team working with JSC reported, at that time, the data as 
presented on Table 6-2. In addition to the nuiny NASA documents they 
found 67 other lessons from MMC: and Airforce documents as well. Based 
on the material discussed at that time the MSFC area showed the follow- 
ing brief statistics: 


Element 

Total Number 
of Lessons 
Applicable 

Applying 
Direct ly 

Meeting the 
Intent 

External Tank 

546 

520 

26 

SSMK 

160 

148 

12 

Solid Rocket Booster 

81 

80 

1 


6. 3.4. 2 Wire Usage and Implementation on Shuttle Elements 

As the result of his Apollo experience the Deputy Administrator 
requested the Panel to review the use of 26 AWC wire and the use of 
teflon on Shuttle. 

The lesson learned Is cited In NAA Technical Note, D-7598, dated 
March 1974, **Apollo Experience Report - Development Flight Instru- 
mentation.** 

**ln LM-1, the scarcity of available space and the consequent 
miniaturization of certain DFI components led to the design of a 
central signal-conditioning unit that had a density of 1600 connector 
pins over a 45-square-lnch faceplate and the mating cable 
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harness consisted primarily of No. 2b /Ire. Alter a series ol 

requirements changes and trouble-shooting procedures that Involved 
moving and opening the signal conditioning unit, some of the wires 
in the harness became fatigued and broken. This problem was also 
nuinlfested in the harness in other areas where cable movement was 
excessive. Ttie situation deteriorated to the point at which attempts 
to rectify certain cable breakages precipitated further breakages 
In adjacent areas From the cabling problems cited, three con- 

clusions can be drawn. First, hlgh-denslty wiring configuration 
should be avoided. Second, signal conditioning should be decent ra 11/ed 
or made renu^te so that low-density connector configuration can be 
achieved to permit easy access and repair and result in Inflexible 
bundles of cables. llilrd, the DFI system involved frequent equip- 
ment changes; therefore, it should use a heavier gauge wire than 
the more pemuinently situate, operat ional- type equipment.** 

Based on data received to date the use of this guaging on 
Shuttle in w«.ring and connections is controlled as follows: 

a. Of the approximately 910,000 feet of wire in the Orbiter, 
most of it consists of 22-AWC. and 24-AWc;. For DFI, signal wiring 

the Orbiter lOl contains about 30,000 feet of the new 2b-AW0 and 
Orbiter 102 about 70,000 feet of it. 

b. The 2bAWc't, when used on Shuttle elements, is made ol 
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an alloy of copper having a considerably higher tensile strength 
than the copper wire referred to in the above Apollo usage. Thus the 
new 2b-gauge wire is closer in strength to the old 24-gauge wire. In 
general the 24 and 26 gauge wire is now stranded nickel coated high- 
strength copper alloy. For 22-AWG and larger the conductor is copper 
as before. 

c. Wherever possible high-density wire configurations are 
being avoided. Signal-conditioning is decentralized in a manner which 
supports the use of low-density connector configurations so as to 
permit easy access and reduced chance of wire fatiguing or bending. 

d. Pin-socket connectors have posed many problems in the 
past due to the need for near-perfect alignment, proper '’Inal seating, 
and the correct electrical circuitry between the lines to the pin 

and socket. A somewhat different design is being used by the MSFC 
elements in that the fixed-portion of the connector now has the pins 
and the mating portion is the socket. This appears to provide for 
easier installation and better mating of the connectors. 

e. Certain sensing devices, such as strain gauges, use 
pig-tails of wire in a gauge size required to meet the size of the 
sensor and the connection to he main wire-run. These are '’5-AWC in 
many cases, but are not more than 8 to 12 inches in length and are 
rigidly fastened to the associated structureat more than one point 
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along the length of the wire. 


f. All wiring on the External Tank la 22-AWC. or larger 
except the DPI data-bua wire which la 24-AWG and the one toot long 
plgtalla on about 70 atraln gaugea which are 2b*AWG. 

g. Tlie Solid Rocket Booater uaea 26-AWG only aa required 

for aenaor plgtalla. Non-ahielded wirea are 22-AWG or larger. Shielded 
wirea are 24-AWG or larger. The data*bua wire iB 24*AWG. 

h. The Space Shuttle M^iin Engine uaea 22 AWG or Larger 
except where there are short plgtalla 

There ia controlled uae of Teflon insulated wire on the SSMl' 
and the SKH. The use of Teflon inside the ET tanks Is still being 
studied. Kapton covered wire Is used on both the External Tank and 
the Orbiter wherever possible. It is a much stlffer and abrasion 
resistant material. Cable or harnesses use the Kapton covered wire 
to act as a sort of **back-bone” for the wire bundles because of 
its tougher characteristics. 

6 . 3 . 4 . 3 CXiallty Control of Screw Threads 

The Panel during Its fact-finding sessions reviewed the quality 
control system on fasteners and their application. It was deter- 
mined that contractors on the Main Propulsion System survey their 
manufacturers of flight hardware fasteners and sample Incoming 
lots of fasteners during receiving inspection. They are using either 
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plug and ring gauges or single element gauging to assure that re- 
quirements of the screw thread specifications are being met. It 
appears that all contractors working with MSFC are using the same con- 
trols now as they have in past programs with NASA. 

As an example, Thiokol, which manufactures the Solid Rocket Motors, 
audits or surveys fastener manufacturers each six-month period to assure 
that inspection records are maintained. The single element gauging of 
threads meets the requirements of MlL-S-7742 and MIL-S-8379. Thiokol 
then samples incoming lots during receiving inspection per MIL-S-105 
using plug and ring gauges. 

On the other hand the External Tank manufacturer, Martin Marietta 
Corporation at Michoud, does not ordinarily survey their fastener 
suppliers. They perform receiving Inspection per MMC Quality Re- 
ceiving acceptance plans that specify either 1007. Inspection or an 
adequate sampling plan. The single element gauging system is used 
both in this receiving Inspection as well as in laboratory shear 
and tensile tests. 

The contractor for the M^iin Engine, Rocketdyne, surveys their 
suppliers yearly and samples each manufacturing lot. The MIL-S-7742A 
and MIL-S-8879 requirements are on contract. There Is thread snap 
gauge inspection on external threads, as well as visual inspection for 
uniformity, damage, and sc on. This is done on a random basis with 
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major diamefera mi^asured by micrometers. MIL-S*8879 threads are 
Inspected on an optical comparator for root radius. Internal threads 
are checked for size using thread plug gages and are visually 
inspected for uniformity » damage, etc. Material tests are performed 
in the laboratory as well. 

No failures attributable to nonconforming screw threads has 
been found in these or associated contractors as a result of a 
detailed search of back records. 

With regard to the Orbitcr it Is understood that almost all 
of the suppliers of threaded fasteners use a single element type 
gage to control their manufacturing process. The two suppliers that 
do not use the single element type gage are suppliers of lock nuts 
which are purposely distorted to provide a locking capability. 

Threaded fasteners which have material strength levels above 160,000 pal 
arc required to meet military and contractor specifications which 
contain both functional and macrosection criteria. Criteria include 
single element as well as functional and special measurements or 
inspections. Laboratory tests are conducted on sections as well. 
Fasteners with strength levels below 160,000 psl are required to meet 
military specifications on thread gaging to assure proper fit and 
function and to assure that the pitch diameters, root diameters, minor 
diameters, etc. are within specifications. Optical projection is 
employed for root radius and minor diass’ter verification. Since all 
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Orbitcr threaded fasteners are listed in the Orblter project parts 
list, other parts can only be procured by the prime contractor or 
Its subcontractors after specific engineering approval. 

6.3.5 Addendum 

As a result of these reviews, suggestions for future examination 
have been put forth, these include: 

a. Is there value in co-locating additional S,R6QA personnel 
within the Shuttle Program Office area reporting directly to the 
S,RAqA office at Level II. In this way they might provide better 
day-to-day support to the S,R&QA Panel and other related activities. 

b. The degree of participation by NASA Centers and all NASA 
prime contractors in the activities of the S,RAQA Panel work. 

c. The experience gained from the landing gear design problem 
which was exposed during the Orbiter 101 test and checkout work at 
Palmdale should be provided to all elements of Shuttle. 

d. Determine the background of the landing gear uplock hook 
failure from the viewpoint of S,RA0A activities at both the contractor 
and at NASA. 

e. The degree of participation by the S,R60A personnel in 
the establishment of test plans and their Implemt'ntat ion . 

6.4 Additional Mission Safety Assessments 

The following material further clarifies material in throe 
areas: (1) ALT mission safety, (2) Requirements Reviews, and 
(3> Abort and Contingency Plans. 
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I 

6 . 4 • I ALT Mlitlon Safety Afofment 

The mitelon safety assessment document Is in review at this time* 

The principal open and closed safety concerns have been discussed for 
' • the Shuttle Carrier Aircraft, the Orbiter and the operations phase • ^ 

« The accepted risks for the carrier aircraft, the orbiter, CiFE and ^ 

^ operations are also shown. This document, JSC 10888, will be updated ^ 

as required. As an example, the list of concerns and risks for the j 

I i 

I ••Operations** phase are: 

I 1. Open Safety Concerns (Implementation of corrective measures 

I 

^ has not been accomplished) 

a. Lack of hazardous gases vent capabilities in the Orbiter hanger 

b. Shuttle Carrier Aircraft empennage/aft fuselage buffet with 
tailcone off. 

c. Orbiter landing gear deployment during captive flight. 

d. Incompatibility of the carrier aircraft with hydrazine fuel. ^ 

2. Closed Safety Concerns 

) a. Hazardous environment around the carrier aircraft. 

I 

I h. Excessive Orbiter wing loads during mated flights. 

3. Operations Accepted Risks j 

1 Incompatibility of the carrier aircraft with ammonia, and possible j 

damage to the vertical stabilizer by ejection seat system outer Orbiter 

« 

► panels while mated. 

* 6.4. 2 Risk Assessment To Support Requirements Reviews 

As in those manned programs preceeding it, the Shuttle program 
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periodically takea Che time Co review and clarify Chfi program 
requlremenca In lighC of Che moac currenC sCaCua and performance 
eaClmacea for Che hardware and aofcware and Che conacralnca of Che 
reaourcea available Co meeC program obJecClvea. A parallel and 
IndependenC S,RAOA review la made wlch reapecC Co every change in 
requiremenCa puC forCh for conalderaC Ion. The degree of Chla review 
la noC fully known. Theac aafeCy orlenCed revlewa a.id aaaeaaim'nfa 
are provided ao ChaC Cechnlcal pcraonnel and aenlor managcmenC can 
conacioiialy conalder Che ImpacC of auch changea before making Chelr 
dec la Iona. Aa an exanple, Che fllghc aafeCy and S.R&QA organlzaclona 
examined aome 340 candidacc cliangca during a recenC requiremenCa 
review covering a period of aeveral moncha. They deccrmlnod ChaC 
abouC 185 of Che candidaCea had no aafeCy ImpacC, while Che ImpacC 
of Che oCher 155 waa IdenClfled for managemenC conalderaC Ion. 

6.4. 3 AborC And ConClngencv Plannlnn 

To undcraCand Che currenC aCaCua of aborC and conClngency planning 
efforCa and hardware /software implemenCaC Ion Che Panel examined Che 
history of this work. This included a review of Che decision process 
Co eliminate boCh Che SRR ChrusC CermlnaClon and Che use of AborC Solid 
Rockec MoCors. Basically chese sCeps were caken because (1) Che AborC 
Solid Rockec MoCors added addiclonal mechanical failure modes and large 
weighC penalcles, and (2) Chore were no credible SRB failures during 
Che SRB burn period because of Che reliabiliCy of such rockeC moCors. 
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Further, the Orbiter te to bo equipped with two SR*71 aircraft 
ejection acate for the first four orbital flights (OPT). These 
have been qualified for and used under conditions exceeding the 
Shuttle ascent trajectory in terms of mach number, velocity and 
dynamic pressure. The ejection seats provide an escape capability 
from the pad to approximately 60,000 feet with these limitations: 

1. The seats probably could not be used for an escape off*the- 
pad with engines running or in the event of an external tank blowup 
and resultant fireball. 

2. They probably would not survive a very rapid breakup of 
the vehicle in the event of an explosion. 

), They also cannot be used during the last 30 seconds of the 
120 seconds of SRB burn or between 80,000 feet and 140,000 fuet. 
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ATTACfflENT 6-1 


IC !• Imporcant Chat aenlor program management 
review both the acopa and resulta of safety analyai'a 
to reinforce early reaoluClon of riaka. Similarly, 
attention ehould alao be given to the acope and 
reaulta of technical management audita to aaaure that 
auch ayatema aa deacrlbcd to the Panel are being 
applied properly. Two examplca are Configuration 
Management and Material Control. 


Reanonac ! Safety Analyaea are being conducted at the project and 
program level. Significant "aafety concerna" are publlahed aeparately 
with rationale for aenlor program management vlalblllty and review. 
Critical Ttema Liata, which Include alngle failure polnta that 
could cauee loaa of vehicle, crew, or mi-^ion are to bo baaellned 
at Che program level, with changea to the baaeline approved at 
program level. In addition, a Mlaalon AaacaamenC Report will 
be prepared for aenlor program rnanagment vlalblllty a,^d review 
at Che program CDR time period. 

Technical aurveya and audita arc conducted according Co achedulea 
eacabliahcd by project and program elementa which may cover 
aevcral technical dlaciplinea or a apcclflc area, e.g., configura- 
tion management and material controla. Cunf iguraC ion management la 
uaually covered In conjunction with the annual S,RAQA aurveya. 
Prcacntly, the materlala control area la receiving apeclal attention. 

A aurvey waa conducted In materlala In June 1975 of Che Orblter 
contractor (Rockwell /Space Division). Another survey la planned 
for the external tank contractor in September 1975, and one for the 
Solid Rocket Booster contractor (Thlokol) In October 1975. 
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ATTACHMEKT 6*1 (ConClmied) 


l*or«l » M«i«Micy .iDtilysea «*Hpociany foi tiboiiM, ditoliiii'i i»mi« 
♦icci tit »»l s , uiiU rango r..«fc*ty should be t'oi.if »l«'t c*iJ e.ii ly < «iok 
to .iruuiro dusiqn solution rather than o|*«m .iMon.* 1 \;o* > • 
arouiuis . 


Rr»xj >c»nne t 


Aborts 


(a) The profient abort analys^H effort In (..•« .if» ni u.i ■ • ' on 

thorn* cases v/ith the highest |>rol)abi 1 i ty of o<o»r*'<-nfc Th • \t> 

the intact nlnirt cacet; and ineJuth* the f<>l loving: 


1. l.ocB ol thrust f ron one 

7. l.onn of TVe for t'nc SFMt’ 

;t . l.onn ol thrust lion om» emirn' 

A. 1 . 0 HS of TVe for um* axis ot PRH 

The abortn witi: a low probability of oc«.*urr'*nce .iV'* tef»Tr''i a;, 
the e«*nt in<i4*ney .ibort 4*aaes. 'Ilionr car.«*i. an* bi iu , > i 

to ti liniiti'd tle«jre<*, in conr.oniim;e with tl.c'ir l«>w i»r' 1*;.bi 1 . ‘ •• t 

oceinronee. (’ontin<j<*ney abort' eiises include fh<? loljowiayr 

1. bona of thrust fion two oi three MG^tK's 

2. hor.n ol TVC for two or three GSMK's 

3. hens of *i'VC for I wo or nore axen of an SPft 

4. Premature Orbiter separation 

5. I’ailurc to separate r>KH from Orbit or/F.T 

For certain n i tuat ionr. , it is not practical to ptovidc for a’-ort 
solutions. For thesi* eases, aonropriate salety m rgins n in hlqh 
faeti'is of reliability have been ineluded in the Fpacc Fit i* ' 
der%i«in to pretrlude their occurrence. Tlu*se can'»s include f!i* fo’~ 
lowiiuf : 

1. Major structural failure 

2. Complete loss of guidance and/or control 

3. Failure to ignite one SRB 

4. SSME or SRB hardover 

5. Failure to separate Orbiter from ET 

6. Premature SRB separation 
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ATTACHMEKT 6-1 (ConCintMd) 


l»i tj'hJjK? 

(10 Oil»in*r (lltclihH tents lM*rn <*omluctc«l .O V *• >i 

(•••iiUT. on Llvno tmir; , Ih*' (»il0ttT niunild aliir • . i m.' 

M.ifiOy on tin* wolor, .isnuminM no mniot nlructn».il hronkni . :• 

Jtmin.iry ni fucturnl •iii.ilyHiti iiullc.it<*n structuinl bio.it.i'.i wi>’ 
piolt.ibly n<*l occur lor rcasr'ii.iltlu dltrhinq condltlonn. i< 

a posnibility of tiu* nldc ciirof:o door lawmlnq durimj n't 

AI tc'iiuito ways arc brinq studied to evacuate the Orhitor in «• '» 

till* rqn'sn df>or in ;jarjned durinq dltchincj. 

Lan d! n q Acet dt?n ts 

(c) An.ilyr.l8 in boinq conducted by JSC and 1<H»’ t^n the •••»' *); 
,d>norpt it*n capability of the Orbiter durinq ImuHtu} accJd .nir 
The purpose of the analysln is tc determine the ability .h.« ^ 

t.’i'i'W compa 1 1 nient aft bulkhead to absorb payload^ loads re t ii' i*' , 
from landinq accidents. * 

Rajuiq_ f>afc t y 

(<l) The It.uitn* Safety .System PDR is scheduled foi Octobe** 1 'i 
tbrouqh Novrrnlu.T 7, 1975. Thin system, baselined over .* v '.mo, 
li.ot not y<M been approved by the Air Porec Mastein Test, e-c' 
(AKI.TU) . In order ta renolve the issuer: raised concern • ^ t ' 
n.i1t*ty mini r cinent n , a joint NASA-USAl* Ad Hoc Committee i" b'.- i 
formed to conduct a technical analysis of the ha/.irds of So*'*'* 
Shuttle flinhts, brrth developmental and operation.il, and ,o < r 'U 
off hazards aqatnst related l.iunch azimuth conntraints an 1 vehicle 
reliability in order to detornlne a loqtcal approach to .armv.’ ng 
public safety. Alternatives will be rccomroonded to NASA iKTr'agc- 
moi»t and the Commander. AFETK, for decision. 
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ATTACHMENT 6-2 



NATIONAL AERONAUTICS AND SPAfE ADMINISTRATION 
Washington. 0 C ^0546 



HiPiv ro 
ATiN or 


Mr. Howard K. Nason 

President, Monsanto Research Corporation 
800 N. Lindbergh Boulevard 
St. Louis, Missouri 63166 


JAN 


1376 

Rcrrfvf 

W nr; • 

^ 0 JAN 


Dear Howard: 

This is in reply to your letter of December 23, 1975, 
concerning potential dangers to Space Shuttle missions 
from nuclear detonations. 

The Space Shuttle Program has taken the potential hazards 
of nuclear activity into account as part of the ongoing 
program effort. At JSC a Space Radiation TVnalysis Group 
is responsible for defining and assessing all potential 
(pre-flight) and actual (real time) radiation environments 
which may be encountered on Space Shuttle missions. This 
effort, as part of the JSC/Rockwell contract NAS-14000, 
includes a subcontract with Radiation Research Corporation, 
Ft. VJorth, TX, and is being administered by the JSC Radia- 
tion Constraints Panel. For Space Shuttle, as in previous 
programs (Skylab and ASTP) , part of this responsibility is 
the assessment of potential hazards from atmospheric and 
axoatmospheric nuclear detonations. 

The assessment of both immediate and long term hazards to 
Space Shuttle from nuclear detonations includes; 

1. Prompt effect computation (flash blindness, 
neutrons, x-rays, etc.) 

2. Enhanced radiation environment definitions with 
respect to time, altitude, position, yield, etc. 

3. Crew and equipment exposure projections with 
respect to time and radiation type. 


4. Biological effects/crew health evaluation. 


ATTACHMENT 6-2 (Continued) 
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The most important aspect of this effort is the refinement 
of real-time support procedures which will allow for timely 
data acquisitions, hazard assessment and implementation of 
related mission rules to insure minimum impact to Space 
Shuttle crews and mission objectives. For example, if 
there is advance warning, the line-of-sight situation is 
avoided, or, if an excessive radiation environment is 
encountered, the mission will bo terminated *and re-entry 
and landing accomplished as soon as possible. 

The liaison necessary to support this effort has been 
established through the Office of DOD and Interagency 
Affairs. The Office of International Affairs also plays 
a part in advising appropriate countries of NASA flight 
plans for manned missions to help minimize the likelihood 
of an inadvertant encounter with a nuclear event. 


As you can understand, there are many aspects to this kind 
of an effort. In connection with the planned Aerospace 
Safety Advisory Panel meeting at JSC next month, you might 
wish to talk to Rod Rose who could give you further details. 


Sincerely, 


John F. Yardley 
Associate Administrator 
for Space Flight 


cc; 

AD/Dr. George Lew 
APA/Carl Praktish 
Gen. Warren D. Johnson, USAF 


IMPLEMEOTATION STATUS - LESSONS LEARNED AS 
APPLIED TO THE EXTERNAL TANK 
(Mid-1975) 
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APPL'D = Ar>plied 
TMPL. “ Implemented 


TABLE 6-2 


SELECTED OPEN SAFETY CONCERNS 

1. SSME Heat Exchanger Leakage 

2. Ice From ET, Impact On Orblrer TPS 

3. Post Separation Impact of Orblter By ET 

4. Use of SRB Nozzle Extension Separation Ordnance During OFT 

5. SRB Ignition Overpressure On Space Shuttle During Lift-Off 

6. Shuttle Potential Collision With The Tower On Lift-Off 

7. I'ire Potential In Orbiter Aft Fuselage On Launch Pad 

8. Pre-Entry Thermal Conditioning Requirement For On-Orbit Contingency Aborts 

CliOSED SAFETY CONCERNS 

1. Access To SRB At Pad For Ordnance Checks 

2. Impingment Of SRB Separation Rocket Motor Plume On Orblter 

3. Shuttle Vehicle POOO Suppression 

4. Propellant Mixing At ET/Orbiter Umbilical During Separation 

5. ET Venting Of Gaseous Hydrogen In-Flight 

6. Jamming Of Payload Bay Doors In The Open Position 

7. Deletion Of Drag Chute Subsystem 

8. Smoke Sensor Provisions In The Orbiter Crew Cabin 

9. Verification Of Crew Module Side And Airlock Hatch Pressure Integrity 

10. OMS Pod And Wing Vent Mechanisms 

11. Possible Forward Fuselage And Crew Module Collapse 

12. Secondary Emergency Escape Provision 

13. Orbiter Nose And Main Landing Gear Deployment 

14. Venting Of LOX Tank Into ET Nose Cap 

15. SRB Separation System Timing 

16. Shuttle Carrier Aircraft/Orblter Release Capability during ALT 

ACCEPTED RISKS 

1. On-Orbit Rescue During Early Orbital Flights 

2. Manual Guidance Capability During Ascent 

3. Emergency Drain System Provisions For ET 

4. Smoke Sensor Provisions In The Orblter Crew Cabin for ALT 

5. Single Eleven Hydraulic Actuator 

6. Bird Impact With Orblter Windshield 

7. Thermal Windshield Panes 
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TABLE 


6-3 


LEVEL II S.R&OA PRODUCTS (SELECTED) 


1. ALT Mission Safety Aosessmcnt 

2. Space Shuttle Safety Concerns 

3. Space Transportation System Payload Safety Guidelines 

4. Vehlcle/Cround Systems Integrated Hazard Analysis 

5. Main Propulsion Test Safety Plan 

6. Main Propulsion Test Integrated Hazard Analysis 

7. FMEA/CIL Status 

8. Criteria And Standards Implementation Plans 

9. SSME Heat Exchanger Pedigree Plan 

10. Acceptance Data Package 

11. .^olnt Surveys of NASA/Contractor Operations 

12. Non- Destructive Evaluation 

13. NSTL Quality Assurance Plan 

14. Space Shuttle Personnel Motivation 

15. Shuttle Orbiter Carrier Aircraft Service Bulletins 

16. Shuttle/Spacelab Interface: Hazard Analysis and Payload Bay Fire Detection 

and Suppression 

17. Space Shuttle SR60A Plan 

18. Interface Assurance Plans 

19. ALT Safety Plan 

20. OFT Safety Plan 
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figure 6-1 

SOLID ROCKET BOOSTER 
FRACTURE CONTROL BOARD ORGANIZATION 





FIGURE 6-2 
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7.0 CROUMD TEST PROGRAM/GROUND SUPPORT EQUIPMENT 


7,1 Introduction 

While this section of the report covers both the Shuttle major 
ground test rpogram and Shuttle ground support equipment the task 
team gave priority to the test program. The major elements and 
major Inter-element systems have reached that maturity of design 
and fabrication where majer ground test programs are being Initiated. 
These major ground test programs are conducted to prove the designs 
do meet performance requirements prior to their use In actual flight 
tests . 

These ground test programs support both the upcoming Approach 
and Landing Tests (ALT) and the later Orbital Flight Tests (OFT). 
Therefore, the Panel's objectives are to assess the degree of 
confidence one can have In the program meeting those goals which 
are dependent upon ground test results, and define those areas of con- 
cern and proposed actions to resolve them. 

As for ground support equipment the Panel has been reviewing the 
plans for acquisition, testing and use of such equipment. In order to 
define those ALT areas which should receive priority attention. 

The Shuttle Program Office response to the Panel's previous 
Annual Report is Included as Attachment 7-1. This covers two Items: 
(1) assurance that the system for defining and Implementing require- 
ments will give appropriate attention to safety and (2) assurance 
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that planning ia aufflclant for Rround teatlnR to maximize confidence 
in safe development flighta. |l■lllll ■■ ■iiiyi 


7.2 Shuttle Master Verification Plan (MVP) 

The Shuttle MVP establiahea Che requirementa and plana for 

verification of the Shuttle ayatom for operational uac, and providoa 

Che mcchaniam for program viaibiliCy and control. Thia plan conaiata 

of eleven volumea covering the following arcaa: 

Volume I General Approach and Guidclinea 

Volume II Combined Element Verification I'lan 

Volume III thru Element Verification Plana (Orbiter, SRB, ET, SSME) 
VI 


Volume VII 

Volunx' VIII 
Volume IX 
Volume X 
Volume XI 


Payload and Payload Carrier Verification (Thia 
ia contained in Voliune XT/, JSC 07700) 

Launch and ].anding Site Verification Plan 
Computer Systema and Software Verification Plan 
Maater Flight Teat AaaignmenCa Document 
Shuttle Orbital Flight Teat Requirements 


The detail of this documentation and the planning 
is to assure the most effective utilization of program 
methods of verification include analysis and/or test, 
on Che amount of hardware in a teat program. Che depth 
program, Che degree of element assembly at which tests 
are based on such factors as Che sophistication of Che 


Chat it represents 
resources. The 
Thus decisions 
of the test 
are conducted 
design analysis. 
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the design maturity at the tloie' of l^atf or *«lUlyaes , the risk 

*• a 4»^. ^ ^ I , 

^ * « 

associated with degree of Icnowledge, the r'oMlexlty of the teat 

,, r .. . ;V./. » 1 . 

artlclea andl^the test program. ' ,J * t ' 


Phases of the verification program have been dlvlded'^lnto (1) 


development, (2) certification, (3)“' 



c/system verlf icatfon. 


(4) acceptance and checkout^ and *(5) ground system verification. 'This 

# 

Is then followed by the "proof of the. pudding" In flight dempnstration 

• • • t' • , 

tests of the mature systems. . The^ light 'demonstration test*. are In two 

phases: (1) the approach and landing test, project dealing with the 

* ' . • • • - 

Orblter and (2) the orbital flight teat program using the entire Shuttle 

* * 1 *a 

systiini of ground and flight equlpfnMt/^i *After.theae phases wtal ^ 

|s * 


Shuttle system'is available for operations. 


The following definitions are taken from the Master Verification 
Plan because they are very helpful In understanding the test plans. 


a. Development testing is the program'which verifies the design 
approach. "• 


k 0 •, 


b. Certification testing is the program of qualification tofits, 
major ground tests, and similar tests and analyses required to determine 
that the design meets the specified requirements. Major ground tests 
Involve a combination of system elements, complex facilities, and large 
or expensive hardware segments. Qualification tests can and usually 
are conducted on components and assemblies within a single element, su.^h 
as the external tank or the Orblter. 
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c. Vertflcatlon tettlng is the proKrsm to prove that the Shuttle 


system meets all designs, performance, and safety requirements. 

d. Acceptance testing is the program that demonstrates that the 
actual part, component, subsystem, or system used in a Shuttle vehicle 
is capable cf meeting performance requirements in such documents as 
the Contract End Item Specifications and so on. 

e. Checkout testing is the program that verifies that the 
hardware /software for a specific mission will function within the 
prescribed fligut limits both at subsystem and integrated vehicle levels. 

f. Flight demonstration is the program that verifies the performance 
of the flight vehicles under predetermined flight conditions. 

7. 3 Review of the Test Program 

The Panel in assessing the confidence level provided by the 
Shuttle test program focused on two areas: (1) the certification program 
for the first captive flight of Orblter 101 mated with the 747 car. '.er 
aircraft and the certification program for the first free flight of 
Orbiter 101 in the ALT project, and (2) the certification program for 
the first manned orbital flight with an "all*up" Shuttle system. 

Although the Space Shuttle ground tests are based to some extent 
on exp. rience gained from such programs as Apollo, Skylab and ASTP and 
the unmanned programs, the uniqueness and resource constraints of this 
program levy different requirements and expectations. Therefore, areas 
of interest reviewed by the Panel included the following: 
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a. The test orRanlzatlons at HASA Cantera and chair contracCora 
with rogard to raaponalblllCy and authority in the Shuttla proftram 
orKanlKation, thair peraonnel nuaib<>ra and akilla, and cha modaa of 
management and communicaCiont 

b. Thoae taata conalderad mandatory prior to flrat flighCa and 
Che rationale for thia daterminaCion. 

c. The logic behind deciaionaon additiona, deletiona, deferrala 
of the teat ruquirementa and Che impact on hazarda and riak acceptance. 

d. The contingency plana to cope with "aurpriaia" which uaually 
occur during any teat program. 

e. Specific attention being paid by Che program to critical itema 
including Chnae Chat have no redundancy, z>g>, wing elevon acCuatora, 
thruac vector control actuatora. 

f. The ayatem for aaauring that the teat rcqulremenCa and procedurea 
as well as hardware configuration control for a apecific piece of hardware 
or aof*'7are demonatrate the flight worChineaa of that (lardwarc or aoftware. 

g. The degree to which the teat program and individual teats add 
up Co an integrated test program and a reasonable basis for confidence 
in decisions on Che flight worthiness of Che Shuttle. 

h. Retest plans Chat assure adequate deomonsCration of vehicle integrity 
after replacements, modifications, repair, etc. 

i. The system Co assess the degree to which model testing, such as 
l/4»acale model vibration and wind tunnel testing, will parallel Che actual 
flight experience and therefore the difference that will have to be 


cinsld«r«d in defining a safe flight teat program. 
J. Specific teat altuationa auch aa: 


1 


I 

I 


(1) The ground rulaa for teating hardware ao that it will 
aae the full miaaion cycle environment rather than juat Ita operating 
cycle environment. 

i 

1 

(2) The rationale for uaing the atructural ground teat program 
aa the baaia i'or certifying the Orblter 101 flight vehicle. 

(3) The rigor of the teating tr aaaure payload doora can be 
cloacd in orbit. 

(4) The ground teat program to determine control capabi Utica 
if a contingency aituation developa where one or more APP'a fail to 
operate. 

(5) The program to accompliah aome form of verification program 
for critical mcchanlama to be aure that they can meet khe conditiona 
preaented in long apace aoaka, long perioda between checkout and uae, 
and long perioda of inactivity on the ground. Such critical mectianiams 
include che many door-control unite on the Orblter, and the flight control 
hardware. 

(6) The rigor of the landing gear deployment teat program to 
aaaure deployment during actual flighta. 

(7) Planned uec of teat teama and ground aupport equipment at 
factory, NASA Center, and apecifically at KSC to aaaure that there ie a 
m«> imum accumulation of experience and aafe teat operation. 
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7.4 Structufl Proof Tttf . Orblt«r lOl 


OrblCer proof tcstii are to provide confidence In early phaaea of 
the flight teat program by verifying integrity and rigging of control 
syatuma and aelected doora. Theae teata aaaure that (1) control atirfacu 
and door mechaniama and the aaaociated structure have the strength 
and stiffness to withstand limil loads (i.e., maximum load expected 
during mission operation) without loss of operational capability, and 
(2) the hydraulic subsystem will provide the necessary stiffness to 
these surfaces to withstand aerodynamic flutter. The loads are those 
expected on the Orbiter 102 during an orbital mission. The test article 
is a flight vehicle except for the following itenin which would not be 
installed at that time: tailcone; thermal seals on the landing gear 

doors and rudder speed brake; elevon surface seals and TPS; crew seats 
and rails; pyrotc''hnic devices; and the use of simulated SSME's. 

The testing will be performed after manufacturing checkout and 
before the ground vibration tests at the RI Palmdale assembly facility. 

The Orbiter 101 will be certified by analysis, and the vehicle will be 
placarded to 75X of limit load for all critical horizontal flight 
conditions. This does not include the thermal stress loads of Orbiter 
102. The flight placards are being developed using ALT weights and con- 
figurations to derive ALT external loading and internal loading indicators 
to compare with the Orbiter 101 detail design and analysis. Hccause of 
the complexity and inherent costs required to separate thermal effects 
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from OrbiCer 101 stress analysis the certification analysis will assume 
that thermal effects are present thus resulting in an additional structural 

The proof tests on the control surfaces of the 101 will develop 
design limit hinge moments with the actuation systems operating and 
' the surfaces positioned at angles of deflection at which limit loads 
will occur. The landing gear doors will be proof loaded. The landi.'ig 
gear itself will be certified by component testing. The crew module will 
be pressure proof loaded to 17.7 psig which is 1107. of design limit 
pressure. Modal surveys at frequencies of body bending and torsion, 
including torsion modes of the wing and fin, will be conducted on the 
Orbiter 101 after factory checkout to substantiate and update the 
dynamic math model by correlating analytical predictions with the measured 
test data. In addition there will be a calibration of the wind root 
strain gages during free flight to further substantiate the analyses. 

This will be done by comparing predicted conditions with flight data so 
that inflight loads will be verified before further explorations of the 
Orbiter flight boundaries. 

To provide a baseline for evaluating the adequacy of this test 
approach, the related information from military and commercial wide-body 
test programs is summarized here: 

a. The L- 10 1 1 underwent a teat program that Included development 
component testing, proof b«diug to the limit load of control surfaces 


and landing gear components, pressure proof testing of cabin to 60Z 
of limit pressure. The compicted stress analyses was accomplished 
prior to flight test. No primary structure proof loading or static 
test article loading was considered necessary. The vehicle was 
placarded to 80% of the limit load. Subsequent testing included a 
full airframe static and fatigue test. 

b, The DC- 10 designs underwent proof loading to limit load and 
this data was extrapolated to verify the analyses prior to fivst 
flight. In addition, the controls of the flight tost aircraft were 
proof loaded and ground vibration tests were conducted prior to 
flight tests. No placards were imposed on the flight test. 

c. The Boeing 747 experience prior to first flight is consistent 
with the DC-10. F’ 11-scale static and fatigue articles were 
subsequently performed. 

The primary structure will be fully certified prior to first vertical 
flight (OFT). The program calls for continuing testing in conjunction 
with analyses of the governing flight conditions. Thus, the static 
test article will be subjected to ultimate loads. Vibroacoustic tests 
will be completed on the aft fuselage test article. Vertical vibration 
tests and static firing of the main propulsion test article also remain 
to be done along with wind tunnel mod»i\ testing. Component tests on 
such items as the window, side hatch, airlock seals and static and 
dynamic seals continues at this time. The Orbiter will not be placarded 
for vertical flight, but trajectory tailoring and adaptive flight control 
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v’ill keep the loads well within prescribed limits. 


7 . 5 .Structural Test Article COrbiter) 

The Structural Test Article (STA) is of a product ion- type Orbitcr 
In two sections, the airframe assembly and the crow module section, xi?hich 
will be subjected to static load testing in a special test serie-1 conducted 
by the Lockheed Company. Dui^ing this major structural test, all major 
parts of the vehicle will bo subjected to limit, fatigue, and ultimate 
loads to Induce design level stresses and prove that all parts are 
capable of taking the expected loads safely. The airframe for STA uses 
substitute hardware for the nose and main landing gear, control surface 
actuators, crew module, OMS/RCS pods, and thermal panes. Thu crew 
module for STA uses substitute hardware for the x^indows and airlock 
tunnel . 

Milestones for the STA program are as follows: 

a. Delivery of the airframe to Palmdale test site during the first 
quarter of 1977. 

b. Delivery of the crew module during the third quarter of 1977 
to Rl/Space Division. 

c. Completion of the crew module tests in the Fall of 1978. 

d. Completion of the airframe tests with a simulated crew module 
in the first quarter of 1979. 

The four series of tests on the STA xvill cover influence coefficients 
such as modulus of elasticity, the limit loads, the fatigue loads and 
the ultimate load. 
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^ Pa V 1 o ■ S- 

Tho iollowiu;’, qiiooiions w'vo askt^d duriiq\ tlu‘ PaMi‘l's «*xamination 
of tho payload bay doox* svstom; What tostiUK ia plannod to aaaviro 
payload bay doora can bo closod in flisdu? What roquiromonts aro in 
tho baaolino for Hxtra Vohionlar Activity (ITVA) capability to ovorcomo 
a problem which provonla door closure? What is the status of the 
development of this liVA capability? Responses to these qiu'stions 
are sunmvtri'.uid below: 

a. The. plained test prop, ram provides for subsystem tests on 
latches and drivi' mechanisms; development tests on structviral materials, 
lubrication, and mechanism latches; qualification tests oimulatinp, 

aero "g" and one "p," opei-ations as well as on-orbit distortions with a 
15-foot section of payload bay door and iiKitinp fixture. Details for 
this test are still beinp, worked out « 

b. The. Payload bay door system is beinp, designed so that for 
manual operation by a crewman in flVA in case there is an on-orbit 
problem with the door. Certain payload configurations and postulated 
failure modes will preclude access to the mechanisms. Thus JSC and 
Rl/Space Division are currently assessing such challenges as the methods 
of ensuring that the doors can alv<rays be driven to an "open" position 
and the allowable number of latches "out" and still have a safe return. 
lilVA routes and working envelopes required for a manual operation of the 
doors are under evaluation. 
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c. Airlock, KVA hardware, and KVA hardware servicing and recharge 
are now baselined. EVA provisions, such as translation aids, work 
stations, etc., have been developed and will be implemented in the near 
future. Handrails already designed for the remote manipulator system will 
provide additional EVA flexibility. The airlock locations and configur- 
ations that form a part of the total system have also been baselined at 
this time. 

7.7 Ground Vibration Tests (GVT) 

There are a number of ground vibration tests that have been 
discussed by the Panel: (1) Orblter (JVT, (2) Mated Orbiter/747, 

(3) Mated Vertical GVT including all flight elements of the Shuttle 
system. The overall ground vibration test prograu. uses the building- 
block approach with tests progressing from one-fourth-scale models 
to the full-scale Shuttle system. Thus the initial verification testing 
of math models and analytical techniques will use the 1/4 models constructed 
of the same materials as the flight articles and made to the production 
drawings. These 1/4-scale models of the Orbiter, ET, SRB's should be 
ready before the end of 1976. After completion of the development 
testing phase at Rockwell they will be transferred to JSC for payload 
integration studies and operational support of the program. 

7.7.1 Orbiter Horizontal Ground Vibration Test (HGVT) 

The objectives of this test program are to determine the Orbiter 
modal characteristics for two support conditions: (1) Orbiter free 
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eulli'd a "soft" vibfaClon tost (Fir.uro 7-1^, ami (I^'l Orbitov 
jnatod-typo called a "ri«id" vibration t«'st (Pi^vifc The soft 

or fr«ei-flip,ht vibration tost will also define the fllp.ht control 
frequency response, characteristics relatinj’; to the deflection and 
slope at control system sensors for known input at the aerodynamic 
control surfaces, These tests are conducted on the Orbiter 101 
or Al.T Vehicle. Thessi^ vibration tests are conducted following the 
structural mechanical proof load tests avul are all conducted at the 
Palmdale facility. Rip, id mount tests are to bepin i'a late .Tuly l‘)7() 
and the soft mount tests are to bepin in mid-Aupust after completion 
of tlie ripid tests, Fipure 7-1 shows the Palnulale checkout flow which 
includes these vibration tests. 

7.7.2 Mated Orblter/747 Uround Vibration Tests 

The purpose of this type of test would be to assess and verify 
the adequacy of structural dynamic modelinp and checkout structural 
response instrumentation. The need for such a test propram is beinp 
examined by Rockwell and then recommendations x.?ill be broupht to the 
Orbiter aitd Shuttle manapement for a decision. 

7.7.1 Mated Vertical Oround Vibration Test Propram (MtIVT) 

This test at MSFG is the culmination of the individual and scale 
model testing. As described to the Panel by the pround test subsystem 
manapers there will be two major integrated vibration test phases: 

(11 a model test of the Orbiter/CT assembly on a soft suspension system 
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and ( 2 ) a modal tost including tho Orbitor, ET, SRB's to invesUigato. 
conditions at li£c-off, high-Q, and burnout. Initially, rigid-body 
modes will ho determined to insure that the natural frequencies of the 
"soft” suspension system can be adequately accomodated. During these testn 
special precautions will ba taken to prevent damage of any kind to tho 
Orbitor and tho BT since they will be refurbislied and used for flight 
hardware, The SRB's will not be used as flight hardware. 

7.8 Fli>xht Control Hydraulic Irfiboratory (FCHI.) 

The objectives of tests conducted on the FGHI, include; (1) veri- 
fication of the. hydraulic system, (2) integrated tests with the avionics 
development laboratory and hybrid computer for verification of end-to-iind 
flight control system, (3) verification of the structural adequacy of 
Che various control surface actuator mountings, (4) verification of 
the flight controls operations during real-time simulated mission 
segments, and (5) development of operational procedures to maintain 
a working hydraulic system. The test article as used in the FCHL Is 
referred to as the Orbiter "iron bird", see Figure 7-4. It uses a 
qualifiable hydraulic system with simulated main engines, simulated 
aersurfaces and actuator mounts, but without landing gears. This 
program has been in progress since late in 197'5 and will continue 
through early 1978. Current work will support the ALT project and 
later test work will support tho first orbital manned test flights. 
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^ ^ firo.w Kacano SvBtom filed Tast: 

Thft objoetivoB of this tost are to verify the capability ami limits 
of the crow escape system for ALT and OFT Including flare, landing, hlgh-Q and 
High-U conditions. Current plans include one static and three dynamic, 
tests to bo conducted at the Holloman Air Force Base test track. Part 
of the work will validate the 6-degroc-of-freedom computer analysis 
for adverse conditions which cannot be tested, An idea of the test 
itself and the items to be examined are shown in Figure 7-5. 


7 . 10 Other Major Tests 

A number of tests are covered under more specific chapter of this 
report, e.g., the Main Propulsion Test program. Others have not been 
examined to any degree by the Panel, e.g,, vibroaeouatic testing on the 
Orblter aft fuselage. Tn addition to the so-called "major testa" the 
Panel expects to review the development and testing applied to some 
of the more critical hardware such as the Auxiliary Power Units, the 
fuel cells, thrust vector control and eleven actuators and others as 
deemed necessary. 
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b, (IhRckoiif and Tnst: (»quipm«nt wliloh is iisod in all Cnsl; and fhiH'koul 
operations. This class includes equipmoaiL that monitors, evaluates and 
stimulates hardware , 

c. Handling and Transportation equipment which is required for 

the movement and support of £lif,nu nardvjare, including slings, stands, etc. 

Auxiliary equipment which aligns, protects and calibrai(*n flight 

hardware . 

1-* Umbllieals which are those items interfa.;ing directly with the 
Shuttle elements to transfer electrical power, olectroxaic signals, am’ 
fluids to and from the flight vehicle systems. 

This area has been given lower priority by the Panel only because, 
of the press of other Panel efforts. To some degree the Panel is in the 
process of scoping the task and defining the most effective approach 
to a continuing review of this area. The Panel began by reviewing 
the adequacy of management efforts to assure safe, cost-effective means 
of processing the Shuttle during all of its 'rest and operational missions. 
The Panel has also reviewed the requirements and constraints placed on 
meeting the. turnaround time and nuintenanetj requirements, as well as the 
arrangements for alternate-field landings by the Orbitor. 

Indicative of the examination the Panel expects to follow are 
the following; 

a. How does KSC monitor the contractors for design and acquisition 
of ground support equipment that is to be used at KSC? What part does 
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.TSG ami MSFC play in tlit* desiy,n> acquisition and use (i.dH? 

b. What aro, the critical elements within the ti;n: svstt'in? 

c. What are the constraints on tiSh development and proeureimmt 
from the point of view of resources and schedule, and what are their 
impacts on the GSK proe.ram? 

d. What are the plans for GSC to support the AI.T project 
beginning, with the preparation for the first flight in earlv 1977? 

7.11.2 GSF Design Review Hoard 

The group was established in early 1974 after the Orbiter 101 
Preliminary Design Review conducted in February 1974, This Board is 
chaired by JSC personnel from the Orbiter Manufacturing and Test Office 

and from the Test Division of the Program Operations Office. Other 

b 

members of the tJSE Board are from Rl/*^pace Division, the Orbiter 

contractors, KSC, MSFC with other members added as required from the 

three NASA Centers. Meetings of this Board are. conducted monthly to assure that 

the. designs are evaluated through a system of reviews similar to that for 

major elements of the Shuttle system (PRR's, PDR's, CDR’s') before approval 

and authority to proceed are given. An example of this activity is the 

OSK lX)ard Review of April 7, 197b in which 37 models of (?SU were reviet^ed. 

The results were that 28 models were approved ( 7 for PRR, 1 for PRR/PDR, 

9 for PDR, and 1 for PDR/CDR, and 10 for CDR) , and two models vjere deleted 
or disapproved. The remaining models of CSE v/ero deferred to the May 
Board for disposition. In addition, during this April meeting the Board 
handled fourteen (14) action items from previous meetings. In these 
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.Il f It'iUt'f! all personnel have an i>pportnnitv Review Item I) 1.^“ 

fjoaitinns IRID) where they feel there is nn Inadequacy. This i.s the 
tuvi!‘ ,is the system used on the various elements of fit' Shuttle 8ysl»'m. 

7,11. t ;sjiJle_Bj Ru Review .Sta tus 

i’ror.rasn studies ari> underway to assure; (11 common hyperp,olie 
serelcinr, equipment to tht‘ optimum e;:tont, (2) appropriate hydraulic 
nerviclnr, and tc'St capability at KtK), O) safe Solid Ri>cket Motor 
hindlln!', operations. The r.reatest numbers of CSM deslp.n re.uievjs will 
iH eur in 197b. As expected, the evolvinf’ maturity of requirements has 
ren'Uteu in i sH;',ht increase o<’ tJSH models sinee Tuly 197'). Tin* 
planning for on-line malncenaiue anil turnaround equipment: and facilities 
f»»r I'R(' is pro)*resslnr, satisfactorily. Maintenance plannlnf; for oL’l-iini* 
i.ine Replaci'ablt* Units (LRU) has been postponed for the present. 

7.12 Addendum 

An updated S!mmi.ary showiiu; the test, configuration, pitrpose and 
e;:pected date of the test is shown in Tabl** 7-1 


201 


ATTAnCillOT 7-1 


Thf pro^’,ram in nssurin^t tho eoaf nfim i ivent'sn of its 
rofiiilremones for p.rouml Buppori t'qotpmont noods to afiadro 
safety receives appropriate attention. 


ttesponsi ; One method of minimi e.ln^*, 0!5i; proj'.ram cost has been to 
institut(' an a^»res8ive effort to assure that the maximum number of 
ofllv end items is common to development test provirams, the Al.'i 
pro^^ram, etc., prior to OFT u8(“n^^e. Ilaeard analyses are bein^' 
conducted on this equipment to assure adcquatt' attention is beinp, 
p.lven to safety. Additionally, the Hpace ilhuttle osiv deslp.n 
requirements have been reduced from tlu* ri'liability level required 
to meet launch windows (Apollo) to a "fail-safe" r**quirement. This 
provides t!SK which can sustain failure without loss ot vehicle 
systems or loss of personnel eapbability. 
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ArrA('!C!F;ta’ 7-i «'om inm>d > 


The ia iu the pf'ri»)U (»i de/’ir.in^ t!v di'tallcd 

rt’quirertu'iit 8 nnd plans for rajor ilf'velcpmtnt and ilit'n 
ii'Stln^';. Plana for p, round toatinp, appear adequate, llaitt ;, “ 
rulaucd toBUlng ihould be monitored to insuri' if ia earriid 
through as planned, Thi' intoraetions between the Orbiter, 
KxternaX Tank, and Solid Rocket hooBter, including separation 
dynamics, are complex. Analyses baaed on g.round testing nhould 
be thoiaugh enough to maximize confidence iji sale devi-i >pr.' . nt 
1 lig.hts. 


Ues pc nise ; As noted by the ASAP, separation dyna 'ics is a subb et 
of continuous analysis backed up by ground test prog.raja, t-Jiud 
tunnel tests ol the AI.T configuration (Orbiter/747 » and the orbit.il 
I Oil! Ig.urat ion (<'rblt''r, IvT, HIlBl 're being conducted to th it i'riine 
sep.u’ation load dynamics. Actual gi*ound tests of the separ.it inn 
hardware undi*r carious load conditions .are planned. For MS, • ite 
Separation loads using load cells in the actual iTig.ht sepucat ion 
system are being, developed. Tra'iectory analysis o" the ALT fk, 
away and the HlUl's and 171‘ si'parat.ions are. being (ontlnnally up- 
dated to investigatu no reci>ntact and aafi‘. separation. For AM, 
iippruxltTUiiely A, 000 computer runs of diffex’ert test. coiuUfionr. 
were investigat ed in special McDonnell Douglas ol tidies te assiu ■ 
sale operational separation margins. These types of analysis iind 
testing will continue viith the specific abjective of assessing, 
coufidimcc in safe development flights. 
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ilij'.ht teotini-'; ol acfospaec vehicles possesses an Inhereuf 
element ol risk owin}» to the eKir.ience of many vinkuowits which 
cannot be resolved in analyses of the wind tunnels or other Rrouud 
tests, 'Ihe need for a flight test prop, ram of the ;5paee Shuttle 
system is readily vipparent given the unique configuration of the 
Urbiter and an assyraotrical launch configuration which includes 
solid rocket boosters and the large external tank for the Orbjt(>r's 
three rocket engines. Another new factor in the early flight tests 
is the use of the Boeing 747 airplane as a carrier vehicle for the 
Urbiter in the Orblter/747 mated configuration, Figure 8-1. 

Hu' eatem of the flight test program is not yet fully delined or 
baselined. Experience has showi\ that nuijor ground tests combined 
x^ith flight tests provides a synergistic approach to defining the 
expected operatiomiL characteristics and understanding the prob- 
lems associated with shuttle missions. Ihe previous section covered 
(he crovmd test program and indicated the limitations of this lest 
program. The additional data expected from the flig,ht Lest program 
is described in this section. 

Tire flight test program involves the verification ol r.uiture 
systems and thus is not to be considered a development program. 
Verification means the process that determines that the Shuttle meets 


the desi^’.n, perlornuu^cii, and safety vequiremcnLs lor l.lii',hl.. iJpeeiiic 
requirements are chosen based on such criteria as (.1) flight data is 
required to verify mission capabilities, (2) it is more effective 
to gather the data in-flight than by other methods, or (3) the data 
will answer questions remaining from the ground test program. 

8.2 Shuttle Flight Demonstration Programs 

The Panel is particularly interested in the process for: 

a. Certification of the systems for the first captive 

and first free flights in the Approach and Landing, Test Project 

(ALT). Certification includes both tests and analysis , i.e. , 
deslgn=requiroments , 

b. Certification of the systems for the first manned 
orbital flight with an all-up Shuttle System in the Orbital Plight 
Test Project (OPT). 

Tlic Panel is currently focusing on ALT and we will review OPT 
as that program matures. 

To give the reader a sense of what has been accomplished and 
the work remaining here is a calendar of major milestones: 

- Completed ALT Pre limJ.nary Design 

Review (PDR) November 1974 

- Completed OFT Preliminary Design Re- 
view (PDR) March 1975 

- CompletedALT Critical Design re- 
view (CDR) April 1976 
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Completed Delivery of Shuttle Train- 
ing Aircraft (STA) 

June/July 1976 

Orbiter 101 Rollout 

Septemoer 1970 

Complete ALT Flight Software Veri- 
fication 

October 197o 

Complete First Approach and Landing 
Development Tests in the Flight Con- 
trol Hydraulic Laboratory 

December 1970 

Complete Design Certification Re- 
view (DCR) for First Captive Flight 
and First Free Flight 

December 1970 

(Complete the FligVtt Readiness Review 
(FRR) for the First Captive Flight 

February 1977 

Conduct First Captive Flight (unmanned) 

rnreh 1977 

Conduct First Captive Flight (manned) 

June 1977 

Complete FRR for First Free Flight (ALT) 

July 1977 

Conduct First Free Flight (ALT) 

July 1977 

Complete OFT Critical Design Review 

August 1977 

Conduct First Manned Orbital Flight 
Test 

March 1979 


8.2.1 ALT Project 

'The ALT project together with analysis and wind-tunnel and 
gromtd tests is intended to evaluate the Orbiter's stability and 
control. In conjunction with subsystem operation, it v;ill verily 
the vehicle's ability to meet airworthiness and periormance require- 
ments dictated by the terminal phases oi the operational and ferry 
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missions. In this case "tcmiinal-illght phase" consists of all 
those activities conducted from an altitude of about 25,000 feet 
to roll-out. This project thus includes such areas as vehicle 
ground tests before the first drop test, preliminary flight evalua- 
tioit, flying quality investigation subsystem verification, and 
demonstration of the unpowered terminal-flight phase. 

The Orbiter 101 used in the ALT project generally will not in- 
clude subsystems required only for space operations but will employ 
simulations of equipment as necessary to demonstrate the effects 
of such systems and payloads on approach and landing perfornumce. 

The Panel structures its efforts on the ALT project so it can 
provide : 

a. A periodic report on the status of preparation for 

ALT. 

b. A flight readiness assessment which the Administrator 
uses in his personal flight readiness review. 

Tlte Panel therefore raises such questions in its review as; 

a. What are the OPT risks that would have to be accepted 
if there were no ALT project? 

b. What are the risks involved in the ALT? 

c. How does the Shuttle Training Aircraft training program 
and other ground based programs minimise ALT risks? 
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4. WjiU ari' tht' aboi’t lapubilit iea lor (ho mivd 

lon'ivMiration and lor tlu' in»livid«al 747 and »>rbilor.’ 

0 . Is tho oMtnt oi Uio Jlivelopment k’llpht Insrrur>t'U“ 
liiMon lor AI,T suiHciini to allow tor amieipatiou oi dovt'lopln,' 

[ . ! as woll as lor real-ilmo problora resolution? 

1. Kliat is the oMent ol "sens! t ivi ty .maiysea" eondm toii 
to det(>rinine the elleet ol input parasue(*r pert tp’bat ions noin e:.- 
iiTuil and internal sources, and what an* the n'sults to daU'? 

)•,. hluu are the data collection .md d.tta reduction 
processe!! and problems? 

h. bluu is the det lull ion ot piloted and autoi'uitii' i ra- 
h'li 'rie!'. durim* i ree-1 lipht and hovj they are matched? Miat an* 
the provisions tor auto-to-Ptanual transition or vice-vi'rsa? 

i. Uliat ii5 the pViH'i'Ss jor dovelopim', the ALT Mission 
S.Uetv iifjs.essment Report? 

As. .in example ot the dialoe.ue with the Program their rciipoieu 
'o the I'.iuel'.s coimnont s. and questions in last year's, nport ari in- 
. lu.ie.i ,vi Attathment 8-1. It cover;; lour areas: fll tree >all 

d.plovmeni i>i tlu landins' r.e.'ir; C’i ALT risks vs beneiits; 

(O the role ol viau-iu-the-loop; .iiui (4) cont inp,eitcy vinalvs.es and 


ranee saiety. 



8.2.2 rilt*.h> Ti>8t Proiort (01^2) 

will demonsirate the total Shuttle systom’o I li^hl -worthiness 
and eapaollity to conduct actual missions, 'fills project oitends the 
th-bltcr tllp.ht envelope trom the ALT limits to Include mated ascent 
with the !,T and SRU's and then separation from them, orbital in- 
sertion and on-orbit operations ol the itrblter and then Its entry 
and landing, 'fills project also is to verify the ability to recover 
the BHb's. In summary the project will demonstrate the compatibility 
of the Shuttle elements for the phases of pre-mission operations, 
mission operations, and post mission operations. 

The current Ol’T project contains a series of si^-manned flipjils. 

8 . ^ Observations on Approach and Landing, Test (ALT) 

As stated in briefings p,iven to the Panel and as written in 
tihuttli' proRrum documents (such as. .J8C 08942, "Flip,ht Test Requiri'- 
menta - Orblter Approach and Landitie,") ," the data and cKperience 
to be s.ained from the Approach and Landinj^ Test (ALT) pros, ram justily 
performing, the tests. No sine.le tost roqulreme it justifies tho effort; how<‘ver, 
the ap 4 »rop,ato return from the several tests does justify the test nropram". 

Based on earlier discussions, prior briefings, and individual 
Panel member e;*;pcrienco, it was assumed that the AL'I prop.ram was a 
mandatory part of the overall Space Shuttle Master Wrification Plan. 

However, the most current Panol/jS(’. discussions indicate that the ALT 
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t-fujcet l8 noc a requlriHl preeuraor for the first manned orbitcil oUl ^ . 

but rather a very worthwhile program to be used in eonlunetlon with .mai? ! i , 
wind tunnel tests and ground tests to evaluate, during approat h and JannJ* : , 
tUo Urbltor's structural, avionleo, eJeetrleal, hydraulic, environmental, IHgU 
»ntrol, and landing subsystems. This observation is reinforced by a eonuu. r 
v.i one of the discussions that the crew for OFT did not have to have Al.'i sl a st 
experience. 

0 . 1 . 1 AI.T ;?anas'',omt'nt. 

ilie oreaniciit ion Unit, riuinagc's tha various element o that make up 
Uie /J.r aiii! Oil' projects within the Hhuttle program ;ire worth noting, 
tor fieveral, reasons: (1) the Panel eannot verify all tleeisitmr. bm 

1 ..USI dt pond on he adequacy oi the basic management system, (2) risk 
rianagt'raent decisions depe>nd on the erg,anie,atlon(s) involved in the 
deeioitni making process, and (1) the review system and its abllil y 
to prevent things from "falling through the crack" Is related to 
aeiinitlon of org,ani;',ation responslbiltieo . Tlie organisation is 
t 'Utllned in figures 8- 2 and 8- '3, Uiauges to this organi::ation 
airang,omont should be expected as the ALT and OH projects evolve 
.;ud there is a better understanding oi the work to be done and 
v;h ‘ri! the emphasis should be placed. Tlve remarks that tollow iden» 
tify the mori' salient details. 

Tlie Johnson 8paec Center Flig,ht Operations Directorate has over- 
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all responsibility for plaunin}’ and cm»ductin}' ^he AI>T projoel .‘ui 
it satisfies t(>"t objectives end test requirements, Hie develop- 
ment of an ALT program and tecimical managermt system was the work 
of the Orbiter Atmospheric Flight Test Office at JSC within the 
Flight Operations Directorate. While the Orbital Flight Test 
(OFT) program detailed plans and organization are being developed by 
the Operations Integration Office at JSC which reports directly 
to the Space Shuttle Program Manager. 

Management reviews are of two types: (1) those dealing with 

the Orbiter 101 vehicle, and (2) those dealing with the AI.T program 
itself, Ttiese reviews are similar in type to those described for 
other elements of the Shuttle program. An example of the reviews 
is the Orbiter 101 Configuration Review (Phase 1) conducted in 
February and March 1976 to assess whether Orbiter 101 subsystems and 
CSE were ready for the subsystem test phase. In the process a list 
of constraints was established which were to be worked off before 
or during the test program. Another milestone review is the Approach 
and Landing Test Critical Design Review (CDR) in March and April 
1976. It gives management another opportunity to review in detail 
the Lest and test support operations to be performed, the facilities 
and equipment to be used, and the management and working relation- 
ships of the test organizations conducting the ALT project. This 
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CDR cove red the acLivation of the AI,T capability, the conduct ol 
the lest program, and the deactivation ol the ALT capability. Ihe 
Review teams for the (U)R included KSC, JSt'., DFRO, Rockwell, and hoeing 
personnel. Ihere was a similar GDR for the Shuttle Carrier Aircraft 
which was conducted during the April-May 1976 time period 
to assure that the detailed production design meets the specified 
re<iuirements . 

The ALT baseline has been defined as to the number of flights, the 
coni igurat ion of the Orbiter (i.e., tail-cone on or off) for specilie 
1 lights, data requirements and on-board computer capabilities, etc. 
These areas are covered in more detail in later sections of this 
report. NASA management at every level, from first” line supervisors 
to the Headquarters' Management have been and continue to givi- the 
ALT p:‘ogram a great deal of attention to assure that this most 
signiticant area has the decision-making system it needs. 

d.3.2 PalnKiale to DRFC 

The Orbiter 101 can be moved the thrity miles from the Palmdale 
Assembly plant to the DFRC either by a ground transportation system 
or by a ferry flight using the 747 carrier aircraft. A number of 
factors were considered: (1) legal aspects of overland movement on 

and off of established roadways, (2) safety aspects of accomplishing 
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a sarioH ol taxi, tests at the Palmdale laeility prior to aetiuil 
lorry operation, 0 ) nbility to al)ort the lirst I'lip.ht., (4) relit" 
tlve costs involved in the move one way or the other, (5) ami 
probability of Orbiter or 747 daraago either way. The overland trans» 
portation of the Orbiter has been baselined. This decision was based to 
a large degree on the operational questions dealing with mated-taxi tests 
and flight out of Palmdale versus taxi and first flight at DFRC with 
tegard to safety margins. 

Tlte configuration lor the lirst flight, if made from Palmdale 
is : 

- Orbiter IbO.OOO pounds 

- tUirrier b0,000 pounds of fuel using flaps at ^0^^ 

- ^tued S50,000 pounds and a vciocit.y of rotation 

(V^.) ol 130 knots 

Tlie Palmdale runway is 12,000 feet in length, ilie Vj. “ lib knots 
would bo reached at about 3b,')0 feet, lifl-off at 147 knots would 
occur at about 4b00 feet and the following 17 seconds at the lift- 
off speed would be available for abort (i.e., from 4,b00 feet to 8,850 
feet along the runway). llie remainder of the runway, from 8,850 
feet to the 12,000 tool mark would be required to hall the mated 
Orbiter/747 vehicle. At the DFRtt/kdwards AFB rvuiway capability on 
the concrete is 13,000 feet and over 7^^ miles on the lake bed. Thus 
there is greater flexibility available at DFRC to handle variations 
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in toko off and extended taxi teats. In fact there is a capability 
to no slightly beyond tax'! testa to actual short-term very low 
altitude tests. 


8.3.3 ALT Baseline 

Tlie ALT has for some time consisted of the following components: 

- Test of modified 747 aircraft by Boeing and DFRC 
Mated 747/Orbiter taxi tests 

- Mated flight tests 

- Free flight tests after mated take off and flight 

A typical tailcone off free-f light ALT profile is shown in Figure 8-4. 

Various NASA and contractor organizations associated with the 
flight test program have been investigating the many aspects of 
ALT to maximize the information return versus the flight capabili- 
ties of the 747/Orbiter system. Studies concern such areas as 
747-Orbiter separation altitudes and attitudes, 747 buffet problems 
associated with mated flight, separation velocities, effects of 
variations between wind-tunnel testing and actual flight aerodynamic 
performance, crew safety, data and data reduction requirements, 
crew training and the final approach trajectory from preflare to 
landing . 
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A major item affecting the implementation of the ALT baseline is 
the impact on the mated vehicle's flight performance and the asso- 
ciated buffet characteristics if you fly the Orbiter without a tail- 
cone. All other concerns are of second order Importance in defining 
the mated and free- flight program. 

Tlie mated Orbitcr/747 will take off with a fixed Orbiter inci- 
dence angle of 4.5 to 7.5 degrees. The weight will probably be 
between 150,000 and 170,000 pounds. The mated vehicle will climb 
to a ceiling altitude (nuiximum climb thrust) and cruise for approx- 
imately 15 minutes. A special rated thrust will then be used to 
achieve a higher ceiling altitude at 200 feet per minute. Ttie time 
duration of this special thrust rating is 10 mii\utes. Once the 
ceiling altitude is achieved, a descent mataeuver will be initiated 
to accelerate the mated vehicle to the desired launch airspeed in 
an equilibrium glide condition, litis will be based oit derivatives 
of pitch rate, flight path angle, sum of aerodynamic and thrust 
pitching moments all equal to zero. Tlte acceleration is performed 
after the thrust is reduced from the special rated thrust ',o the 
maximum continuous thrust level. The Orbiter eleven is tc be 
positioned to a predetermined value to achieve a relative normal 
load factor of 0.75g and an Orbiter pitch acceleration of approx- 

9 

imately 4.0 degrees/second*. During the mated descent phase, the 
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747 will be con£if»,ured to increase drap in order to enhance separat imi. 
Separation is to occur as the launch airspeed and equilibrium >',lidc 
conditions are achieved. The typical AIT baseline is shown in 
Figure 8-3. 

The baseline ALT progi'am, taking into account the many studies 
conducted , is : 

a. Reduction in the 747 tests by Booing. 

b. Mated tests with 747 and Orbiter with t.»il-cone on. 

Taxi tests plus 6 flights with inert Orbiter. 

Taxi tests plus ^ flights with ac tive. Orbiter. 

c. Free flight tests coiiducted with tail-cone on. 

4 flights to land on the lakebed runway, 
flight to land on the concrete runway, 

d. Free flights with tail-cone off if possible. This 
decision will be based on data obtained in all of the previous 
flights along with wind tunnel tests and a detailed analysis. 

Curiv^ntly the program calls for 3 flights to land on the lakebed runway. 
This would be preceded by a mated active flight test with tailcone off. 
The number of flights and their content is under review. 

Ttie tailcone refers to the aerodynamic co .i.eal shaped body 
attached to the Orbiter to reduce drag and reduce, buffeting of 
the 747 tail sections in particular due to carrying the Orbiter 
piggy-back. Tlie extent of the buffeting with tail-cone off would 
be severe tests and analyses indicate that. ITte buffetitiig can se- 
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vei’oly reduce the structural llle ol the 747 tall particularly the 
aft body structure and vertical tail section. It can also prevent 
the crew from achievinR necessary proficiency during the critical 
release and separation maneuver period. Finally it can generate a 
general fatiguing vibration during all portions of the mated flight. 
Uncertainties exist in scaling buffet loads from model scale to 
full scale because there is no real methodology to accomplish such 
scaling; therefore, additional critical areas could bo affected. 

If buffet loads were In error by a factor of two, the resulting 
fatigue life calculations might be in error by a factor of as much 
as ton. Considering svtch uncertainties the Shuttle program has 
used a conservative approach to defining the expected fatigue life 
values, 

Tlie 1,4 hours of a single ALT test mission approaches the age 
life of the aft body section at the tail. Tlie vertical tail section 
computed life is about 10 hours. These times can be increased through several 
means Including the use of an 11.7 degree Body Flap Up and beefing~up the 
structure In the body and fin areas. This is being done to Increase the 
lifetime to approximately 50 hours before the first crack appears. While 
flying the Orbiter with the tail-cone on relieves the buffeting 
problem , the aerodynamic performance of the Orbiter during free flight 
is not exactly equal to that which would be experienced with the true 
Orbiter configuration. This has also been examined and it has been 
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sui^gestcd that the Orbitor with tail-cone-on erm be ituule to behave 
more like the mission tonfigured Orbiter by doployinjt the rudder 
speed brakes, Hiis does appear thoup.h to cause a some decree of 
loss in pitch control. 

For the reader to follow the evolution of the pro^tam it Is 
worthwhile for the reader to understand the terms used (I'ij’ure 8-6), 
the reqviirements for unpowerod landinjt (!'ij»ure 8-7), unpowerod tliji’.ht 
constraii\ts (Figure 8-8), and the Autoland logic (Figure 8-9). 

8.8. 4 Deployment of Orbiter Ijandlng dear 

The Panel was interested in the basis for confidence in the 
ability of the gear to deploy and lock into place prior to touch- 
down and the aerodynamic affect of having the gear deployed during 
mated t light. 

liie free-fall deployment system has been examined not only by 
the engineering and test personnel but also by the highest levels 
of Shuttle management to assure that it will operate properly. As 
a result of this review the free-fall mechanism has beeit augmented 
by additional spring devices. Once the doors are open aitd the gear 
are partially deployed the combination of initial downward momentum, 
aerodynamic forces and the mass of the gear appear sufficient to 
fully deploy and lock the gear. Hydraulic actuator deployment 
force is also available. There will, of course, be a detailed 


225 


and thorough test program to provide further confidence In the 
adequacy of the syetera. The specification for the deployment 
window of time during which the gear must safely be lowered calls 
for a maximum of 10 seconds, but at this time analysis Indicates 
that it will take about seven seconds, 'fhc gear retraction is 
accomplished only on the ground and cannot be done in flight. 

It is planned that during one of the mated (captive) flights 
that the Orbiter landing gear will be deployed during landing rollout. 
Tliis will permit information to be obtained on the aerodynamic 
characteristics of the Orbiter as it will appear in actual flight 
just prior to touchdown. Current Indications arc that this will 
not cause undue buffeting of the 747 carrier aircraft. 

Further discussions of this area of concern are found in the 
"Risk Management" section of this report. 


8.3.5 Orbiter/747 Separation 

The separation sequence, when free flights begin, is perhaps 
one of the more significant areas of concern. The overriding re- 
quirement is that there be no recontact between the vehicles once 
separation begins. The degree to which analysis can define the 
envelope of separation is dependent on the accuracy of wind tunnel 
data and the inherent aerodynamic uncertainties therein. 

The variables associated with this maneuver are; 
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(a) Orbxter/747 aerodynamic unceriaintics. 

(b) Orbiter incidence an^'le (currently 6® - 

(c) Orbiter body flap, speed brakes, elevon posiixoi o iv.d 
capabilities . 

(d) Separation "g" requirements. 

(e) Flight control system comiiiand mode and rates. 

(f) 747 spoilers, thrust position and capabllitit i,. 

(g) Mated altitude and speed. 

in order to obtain a greater degree of understand in>; u» the 
ALT dcRii,n and performance characteristics as well as the ri 3»- j tu- 
volveU activity continues in the following areas: (1) Te6.,i;.g, 

part ieularly wind tunnel work, (2) analysis,, particularly t > un- 
cover areas that can be improved, (3) simulations and pilot tt. lining, 
(4) refinements of flight test data and instrumentation rcquii en-etn 
to gt t the most data lor the effort involved, 

Figure 8-JO snows pictorially the clearance requirements ''o 
•u para t ion. Tlte aesign goal and maximum allowable motion c-i. • both 
shetm . 

Simulations have been conducted many times on the ALT l”‘ights. 
'Hiese have been run by the "Separation and Pilot Operatious i:ro ip" 
at Rockwell and at least five pilots from the NASA/JSG astrotuiu' eorp 
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Results from these simulations Indicated that thet'C would 
be no vortoK eloarancc problems for either the tailcone on or off. 

Tlie effect of Orbiter weight and c.g. location did not have a sirr 
nlficant affect on the separation or Orbiter perfornuuiee. While an 
Increased launch speed from 2(>0 to 280 Keas did not significantly 
affect Che separation trajectory, it does appear to improve pcr- 
fornumce for the final approach condition. 

Tlio tailcone on configuration was noted to have a beneficial 
effect from two aspects: (1) Oi-biter/747 separation was better 

with a near vertical deplacoment of the Orbiter relative to the 747 
for the first few seconds, and (2) Orbiter ALT final approach con- 
ditions wore significantly better than for the tailcone off con- 
figuration. 

The effect of wind/ shear, discrete gust, and random turbulence 
were within the baseline capability and did not present a separation 
problem or appreciably affect the Orbiter handling qualities. As 
a result of the simulations and analyses to date, the following 
separation and post separation conditions have been established: 

(a) Separation Initial Condition 

1. Normal relative load factor « 0.75g. 

2. Orbiter pitch acceleration ° 4.0 degrees per sec". 

3. Launch airspeed “ 260 Keas. 
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4 , Kquiltbrium . 

(b) Peat Separation Conditions tor Orbiter 

1, AuCotrim enabled at separation. 

2, Post separation (tree-tlir,Ut) iCS surtace 
limits wiM, be selected at separation. 

3. Maintain /Vsec pitch rate command tor i seconds 
tollowed by a 2 second stabilii’.ation period. 

4. Maneuver to ALT interlace. 

(c) Post Separation Conditions for 747 

1. Initiate 747 evasive maneuver (bank) at t,.j,p 
4 5.0 seconds 747 wheel command of 50° 

for lo seconds with 747 PCS in autopilot 
mode. 

2. There is a possibility that u recoimnondatlon 
will bo uuulc to use a bank maneuver of 30*^ 
at approximately lO^/soc. with the 747 R..5 
in a manual direct mode. 


8.3.0 Crew Kmorgcncy EKross 

bmer>’,ency egress during ALT means both escape from the 747 .md 
escape irom the Orbiter. The system for the Orbiter 101 vehicli 
coitsists 01 ejection seats traveling on rails with overhead ejection 
through doors cut in the top of the cabin. Ihe emergency oysiew 
for the crew of the 747 has boon somewhat more difficult to base- 
line. After technical studios and numagement discussions it was 
determined that thort should bo a specific escape system placed 
into the 747. The design selected is a tunnel going from the flight 
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deck whore the two crewmen are located to a point on the lower left 
side of the 747 fuselage, Figure 8-11 Tlte lower end of the tunnel 
is opened by a pyrotechnic severance system that cuts the fuselage 
thereby permitting the crew to exit from the flight deck to the 
outside. At the same time ao the fuselage is cut it is necessary 
to equalii^e the pressure between the cabin and the atmosphere by 
blowing out (or in) windows and a portion of the lower right side 
skin, 'file Teledyne-McCormiek-SeXf Company has boon Bcleeted to 
provide this egress system. Tests and analyses will be conducted 
on this arrangement to assure the smooth cutting ol the metal skin 
and the proper rate of decompression. Training, oi course, will 
be required to assure the crew can and knows exactly how best to 
escape ii the need arises. The system will be designed tor the 
20,000 feet to 24,000 feet range of altitudes. 

The Orblter ejection seat is a "zero-aero" seat. The first static test 
of the Orbiter 101 ejection seat is to take place at the Holloman AFB High 
Speed Test Track during January 1977. Hatch jettison tests would begin in 
March 1977. The first manned ALT flight (captive or mated) is set for May 1977. 
Testing of the overhead hatch has been in process for some time and 
qualification testing on the energy transfer subsystem is essentially 
complete. Two anomalies wore noted regarding the operation oi the 
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hatch: (1) detonation velocity indication was lost during, one K rjt 

but the output ol the charge was satisfactory, and (2) one 0.^> sicuad 
time delay timt'»data was lost during testing. Neither of these 
appear significant and theix resolution is expected soon. 

'file Critical IXislgn Review on the outer panel severance system 
was completed, Qualification of this sytem is to start In May 197b. 
Durfng the development testing of the inner panel severance system 
the following anomalies were noted; (1) failure of the panel to 
sever, and (2) gas leakage into the crew compartment, Tlie inner 
panel failure was due to using the wrong material in the oubr.cale 
test panels. A new test using proper materials is in the works 
now. 'Hie gas leakage into the crew compartment was due to expend- 
ing tube rupture during overload or hot temperature nominal load 
tests, Apparently there is small margin between severing the panel 
with an 80% charge and containing the gas using a ll'j'Z charge, be- 
fore start of the qualification program this problem will have to 
be resolved. See Figure 8-12. 

8.3.7 Additional Notes of Interest 


8. 3.7.1 

'fhe Gulfstream Shuttle Training Aircraft, as an inflight simu- 
lator, will provide some important data for the first free-flig.ht 
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of the Orbiter. However, the fidelity of the simulator is based on 
the wind tunnel data and it will be as good as the interpretation 
of the data by aerodynamicists. The USAF and NASA have frequently 
seen significant differences between wind tunnel data and flight 
data. 


8 . 3 . 7. 2 

The 747 flight cest team is in a monitor role with the 747 crow 
in control of "going ahead" and the Orbiter crew in control of the 
decision on separation or "abort" of the free- flight mission. There 
is to be no overlap of authority and the conmiunications system is 
to in no way "shut off or overlap" the flight crevrs. 

8 . 3 . 7. 3 

The factors which need co be accommodated in planning the Approach 
and Landing Test Project include (1) possibility of limited or no 
capability to carry and launch a tailcone-off Orbiter from the 747, 

(2) definition of the flight performance margins afforded by a 
tailcone-on first free flight, and (3) need for exercising ALT cur- 
tailment options for unanticipated contingencies, cost constraints, 
schedule constraints, etc. 

8. 3. 7.4 

A preliminary ALT manned Orbiter contingency operation plan has 
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boon produced, llio evolution and implementation oi this plui\ will 
bo iollowed by the Panel. Tlic purpose of the document is to describe 
the immediate actions and responsibilities to bo used in the event 
ol a catastrophic situation when the Orbiter is nuuwed during the 
Al.T operations. Procodvires for catastrophic events occurring, at other 
t,imos will bo described in appropriate documents lor both the p, round 
crew and the 747 teams. 

8 . 4 Mmnod Orbital Flinht Tost Program 

At this time the t)lT rtuiilolines are. that the OFi' will consist 
ol -lx lliphts. Ihe first llipht will bo nuinnod and couducte»l with 
greater thai\ nominal perfoniiance nuirp.inps. Tlie perfornuince envolopi* 
will be p.radvially expanded staying withiii the operational doslpn 
capabilities of the Shuttle vehicle. 

Its crow will consist of two men on lliphts one ihrouph four 
v.'ith an option ol four men vm flights live and six. Tlie data le- 
turn requirements are to be principally lor enpineorlnp, infornuuion. 
Scientific data will be obtained on a i\on-lnterlerence basis. lU-'I 
will be flown on all six fliphts. ihuuUdate payloads will be used 
whenever possible, consistent x^ith the availability mtd cost elfec- 
t iveness of the payload versus the mission to be flown. 

Tlie major areas of planning include the followinp,: 

(a) Definition of orbital flight test plans. 


233 


(b) Dcvelopmcsnt o£ operating cm\eept s and rotiulromoni!!. 

(c) Dc'volopmcnt ol training requirements and implementation 
oi trainers and simulators. 

(d) Development and Implementation oi control center ami 
network requirements and cap.abilities. 

(e) IX'velopment oi flight planning capability. 

(£) Development of the launch and landing {»rovmd oper- 
ations and interface with flight control. 

One problem i\oted duri,i\g our JSO discussions was the use of 
"add-on" units contaii^ing large quantities of liquid ammonia to be 
used as part of a cooling system for DFl equipment . These add-ons 
were located in the Payload bay but the vent system was not dis- 
cussed at that time, nor were the steps that wovild prevent corrosion 
due to the ammonia fumes. This area will be followed by the Panel 
in future reviews. 

8 . '» Addendum 

The first flight of the modified shuttle carrier aircraft is 
scheduled for the end of November or early December 1976. The aircraft 
design gross weights have been stated as follows: 

Taxi 778,000 pounds 

Takeoff 775,000 pounds 

Landing 585,000 pounds. 

Most of the modifications made to this aircraft are shown in Figs 8-H,14. 
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The ()rbltor flare techniques arc still under study to assure that the 
oeloctod mode will be most effective in achieving the objectives of 
the ALT project. Float time requirements, the time interval available 
to the pilot during which he can adequately perceive sink rate and 
adjust it to arrive at an acceptable value for touchdown, should 
fall near the following: 

a. A minimum time of seven (7) seconds and an optimum of 
11 to 14 seconds. 

b. For precision landings the last three (3) seconds should be 
flown at essentially constant altitude. 

The need to have a least one free- flight landing on the concrete 
runway at DFRC is predicated on the difference between lakebed surface 
and conrete runway surface on landing gear-wheel-brake effects. The. 
difference in coefficient of friction and other surface effects on tlu' 
gear dynamics and anti-skid tuning are sufficient to nuxke a conrete 
runway landing worthwhile. 

Landing gear test problems have occurred during the checkout and test 
work being conducted at Palmdale Facility when an uplock hook failed. 
In addition they have found that the other uplock hooks had cracks. 
Plans are for an investigation by Rl/Space Division and NASA/JSC Lt- 
be done in two phases; Phase I for Orbiter 101 and Phase II for 
Orbiter 102 and subs. Ground rules being utilized are: 
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a. Review all criticality I single point mechanical failures 
that can cause loss of vehicle or crew, 

b. Both sides of the loaded interface will bo reviewed for 
design criteria consistency, for example, the actuator load rating 
versus mechanical joint design load used in the analysis. 

c. Phase I and II refers to hardware first usage and not loads. 
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ATTACHMENT 8-1 


Free fall deployment of landing gear may introduee safety 
problems. Therefore, the u.90 of a positive system for rapid 
extension of landing gear should be considered. 

Response ; The basic design of the landing gear system is conser- 
vative with four forces acting to deploy the gear, the up-lock 
actuator, the weight of the gear, the strut actuator, and the looking 
spring bungte. 

The concern about positive rapid extension has been recognised. 

Plane to utilize pre-loaded springs as additional forces to pop the 
doors and speed the gear deployment are being iiwestigated. 

A comprehensive test program using both a nose gear and main gear 
simulators with flight type gear and door hardware with hdraulic 
systems and electrical systems in the OV 101 configuration will be 
tested at Rockwell International. Loads simulating aerodynamic 
forces obtained from wind tunnel tests, will be applied to the gear and 
door assemblies during these tests. Wind tumiel tests of a 1/3 scale 
model will be conducted for aero loads with gear retracted and deployed 
as well as tests on a 0.04% model for loads at incremental positions. 
Additional studies are continuing on the usefulness of extending the 
landing gear during a 747 captive flight. 
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ATTACHMENT 8-X (Continued) 


More information is needed on the risks of Approach and hand- 
ing Testing in comparison with the value of information which 
would be obtained in such flights. 

Response ; The Approach and handing Test (AhT) program objectives 
are as follows: 

1. Verify an Orbiter pilot guided approach and landing capability. 

2. Demonstrate an Orbiter subsonic auto TAEM/auto land capability. 

3. Verify Orbiter subsonic airworthiness, integrated system oper- 
ations and selected subsystems operation for first orbital flight, 

4. Demonstrate Orbiter capability to safely approach and land in 
various center of gravity configurations. 

These important objectives can be accomplished with acceptable risks. 

Extensive analysis, wind tunnel testing, and man-in- the- loop simu- 
lations have demonstrated the safety of the ALT test flights. A com- 
prehensive matrix of separation configuration and aerodynamic para- 
meter variations has been analyzed. There have been approximately 2,200 
hours of wind tunnel testing, 200 piloted simulation runs, and 3,000 12 de- 
gree of freedom separation trajectories completed. Numerous variations 
in configuration, control modes, aerodynamic coefficients, altitude, 
velocity, and flight path angle have been studies. Safe, acceptable 
separations are produced within a large envelope of conditions. 

The top launch concept has been employed successfully in the part. 

Programs employing the top launch concept include the British Mayo 
Composite Aircraft, the German Mistel, and the French Leduc. 

The ALT program decreases overall Space Shuttle Program risk. The 
Orbiter is a highly sophisticated combination aircraft/spacecraft 
with a digital, fly-by-wire, flight control system. ALT provides 
for the detection and correction of problems in the important approach 
and landing regime prior to the orbital flight tests. The ALT tests 
will essentially verify the aircraft capabilities of the combination 
aircraft/spacecraft Orbiter. 

The remaining issues being examined relate to the launch altitude of 
the Orbiter from the 747 and the launch configuration of the Orbiter 
(tailcone on or tailcone off) . These issues are being reviewed by 
the OSF Management Council with JSC and FRC on October 8, 1975. 
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ATTACHMENT 8-1 (Continued) 


Tlie role o£ jnan-in-Lhc-loop, especially during landing,, 
rollout and braking, needs re-examination as the program 
reaches the point where avionics capability and limitations 
are bettor known. 

Response ; Tlie Space Shuttle Program engineering simulation activity 
has been reviewed as a part ol the overall avionics development plan, 
Tlxis review reconsidered all the simulation requirements and adjusted 
the plan to better balance the design £roo«c dates with the avail- 
ability of adequate engineering data, 'ihe final decisions on the 
role of man-in-the-loop particularly during landing have not been 
made and are not scheduled until early 1976 . Duriitg this time period, 
ADL testing including some tie with the hydraulic systems will have 
further defined the control system characteristics. (?ain and brake 
characteristics together with landing aids analysis need more work 
before final decisions in this area are committed. Tlie program is in 
agreement with the necessity for good judgment coupled with adequate 
data in this area. Reviews of the specific landing characteristics 
and techniques are planned. 
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ATTACHMENT 8-1 (Continued) 


Contingency analyses especially for aborts, ditching, land- 
ing accidents, and range safety should be completed early 
enough to assure design solution rather than operational 
work-arounds , 


Response ; 


ABORTS 


(a) The present abort analysis effort is being concentrated on those 
cases with the highest probability of occurrence. These are the in- 
tact abort cases and include the following; 

1. Loss of thrust from one SSME. 

2. Loss of TVC for one SSME. 

3. Loss of thrust from one OMS engine. 

4. Loss of TVC for one axis of SRB. 

The aborts with a low probability of occurrence are referred to as 
the contingency abort cases. These cases are being studied, but to 
a limited degree, in consonance with their low probability of occurrence. 
Contingency abort cases include the following; 

1. Loss of thrust from two or three SSME's. 

2. Loss of TVC for two or three SSME's. 

3. Loss of TVC for two or more axes of an SRB. 

4. Premature Orbiter separation, 

5. Failure to separate SRB from Orbiter/ET. 

For certain situations, it is not practical to provide for abort 
solutions. For these cases, appropriate safety margins and high 
factors of reliability have been included in the Space Shuttle design 
to preclude their occurrence. These cases include the following; 

1. Major structural failure. 

2, Complete loss of guidance and/or control 


240 


ATTACHMENT 8-X (Continued) 


3. Failure to ignite one SRB. 

4. SSME or SRB hardover, 

5. Failure to separate Orbiter from ET. 

6. Premature SRB separation. 

Ditching 

(b) Orbiter ditching tests have been conducted at Langley Research 
Center, liaaed on these testa, the Orbiter should be able to land 
safely on the water, assuming no major structural breakup. Preliminary 
structural analysis indicates structural breakup will probably not 
occur for reasonable ditching conditions. There is a possibility of 
the side egress door jamming during ditching. Alternate ways are being 
studied to evacuate the Orbiter in case the egress door is jammed dur- 
ing ditching. 


Landing Accidents 

(c) Analysis is being conducted by JSC and LRG on the energy absorption 
capability of the Orbiter during landing accidents. The purpose of the 
analysis is to determine the ability of the crew compartment aft bulkhead 
to absorb payload loads resulting from landing accidents. 

Range Safety 

(d) The Range Safety System PDR is scheduled for October 15 through 
November 7, 1975. This system, baselined over a year ago, has not 
yet been approved by the Air Force Eastern Test Range (AFETR). In 
order to resolve the issues raised concerning range safety requirement:;, 
a joint NASA-USAF Ad Hoc Committee is being formed to conduct a technical 
analysis of the hazards of Space Shuttle flights, both developmental .'Uid 
operational, and to trade off hazards against related launch azimuth 
constraints and vehicle reliability in order to determine a logical 
approach to assuring public safety. Alternatives will be recommended 

to NASA management and the Commander, AFETR, for decision. 
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TEE ALT OSGANIZATION 
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AUTOLAfID APPROACH LOGIC 
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INNER AND OUTER PANEL SEVERANCE SYSTEMS 



Permanent (Type I) Structural Modifications 



■able (Type II) Structural Modifications 




9.0 EXTERNAL TANK 


9.1 Introduction 

Information contained in thla section of Che report is current 
through the second quarter of calendar 1976. The latest data ineludos in 
formation for the period through the External Tank Quarterly Re- 
view in May 1976, which was conducted at the Mlehoud Assembly Plant 
in Mississippi. This overview covers Che design status, weight status, 
development and qualification tests, significant concerns and Issues 
associated with this program. The results of hazard analyses and 
failure modes and effects analyses arc contained in Section 6 (Risk 
Management) of this report. Discussion of schedules and milestones 
are provided where it is felt that they have a bearing on the status 
and/or problem resolution or interfaces with other Shuttle elements. 

The External Tank consists of five systems - (1) structures, 

(2) propulsion, (3) electrical, (4) thermal protection, and (5) inter- 
face hardware. Related ground support equipment is discussed in the 
GSE section of this report. 

9.1.1 Backgrouni.! Description on the System 

Most active components for Che propellant system are contained 
in the Orblter to minimize throwaway costs. At liftoff, the External 
Tank (ET) contains approximately 1,550,000 pounds of usable pro- 

3 

pellant. The liquid hydrogen tank volume is 53,000 ft and Che liquid 

3 

oxygen tank volume if 19,500 ft . These volumes include a 3% ullage 
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provision. The hydrogen tank is pressurii'.ed to a range of 17-19 pslg 
and the oxygen tank to 20-22 psig, Antivortex and slosh baffles are 
mounted in the oxygen tank to minimi«e liquid residuals and to damp 
fluid motion. Five lines, three for the hydrogen and two for the 
oxygen, come together with the same number of lines in the Orbiter 
at the EX/Orbiter interface. Both tanks arc constructed of aluminum 
alloy skins with support or stability frames as required, and their 
skins are butt- fusion-welded to provide reliable sealed joints. Spray- 
on foam insulation (SOFI) is applied to the complete outer surface in- 
cluding the sidewalls and the bulkheads. SLA-561 ablator nuiterial is 
applied to selected areas, such at) the atcachiiienfc structures, wJtcre 
shock impingement causes increased heating. 

9.1.2 Structures 

Struccural design is complicated by the iH>ed to meet the inter- 
active load effects resulting from (1) the temperatures and pressure 
requirements of the internal propellants, (2) external heating and 
pressures due to aerodynamics, and (3) the loads associated with 
Orbiter and Solid Rocket Booster interactions during the ascent phase 
of the mission. The hydrogen tank is a fusion-welded assembly of 
barrel sections, I-Ring frames, and dome sections. A frame at the 
juncture of the foirward dome and forward barrel eontaira an integral 
flange which joins the hydrogen tank to the intertank and also provides 
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the otrueture for the Orbiter forward attaGh point, llie OKyp,en tank 
is of ORive shape to reduce aerodynamte drop, and aero thermodynamic 
hcatin^^, A rinp, frame at the juncture of the dome and cylindrical 
section contains an intcpjral flaiu»e lor joining, the oxyp.en lank to 
the Intertank. Tlie intertank is a 8ktn/strlnp,cr/lrame structure oi 
cylindrical shape and includes a heavy beam which spans the inter- 
tank. The ends of the beam contain the BHll thrust fittinf’o vdilch 
are the EX/BUh forward interface points. Flany.eo at either end of 
the intertank provide the attachment to both the or.yf’.en and hydrogen 
tank elements. A frame at the juncture of the aft dome and the aft 
barrel of the hydrogen tank contains the structure tor the aft BRB 
attachment and also the structure for the aft Orbiter attachment. 

9.1. 1 Promilsion Hvstem 

The EX contains all the hydrogen and onygen for the Orbiter' s 
main eiagines, Also, the EX propulsion system serves the primary 
function ol delivering the oxldiaor and fuel to and from the pro- 
pellant tanks and the Orbiter it\terfacc. Delivery rates to the 
Orbiter are approximately 45,300 gpm for liquid hydrogen and 17,000 
gpm for liquid oxygen. All controls and valves are located i:i the 
Orbiter except for the LOX and LHp vent/relief valves, the tumbling- 
system pyro valve, check valves in the helium inject line, and those 
valves integral to the interface disconnects. Propellants are loaded 
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and off-loaded throuKh the Orbite'^ into the ET. As for loading ratea, 
maximum flowi are 12,000 gpm for hydrogen and 5,000 gpm for oxygen. 

9.1.4 Electrical jtyatem 

The electrical system provides for propellant level sensing, 
instrumentation functions, electrical power distribution, tumbling 
capability and light ning protection. Tlierc arc two dls*;Us?t sets 
of instruments, the operational instrumentation and the development 
flight Instrumentation. Tlxe development flight instrumea»^atlon is 
carried on the first six flight articles. Subsequent flights will 
have only operational instrumentation, which is hard-wire interconnec- 
tions of sensors without ET electronics. All ET electrical power is 
derived from the Orbiter, 

9.1.5 Tlxermal Protection System 

llxe TPS performs a multipurpose role during prelaunch and flight 
phases. Its major functions are (1) to maintain the primary structure 
and subsystem components within design temperature limits, (2) control 
prclauneh boil-off rates, (3) contribute to maintenance of proper 
propellant temperature at Orbiter inter fact, (4) prevent liquefaction 
of air on the hydrogen tank surface, and (5) help prevent accumulation 
of ice on the external surfaces of the ET. 

During the ascent phase Che TPS helps to minimi.'’, e the unusable 
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liquid hydrogen resulting from thermal stratification. During entry 
of the ET, structural temperatures and tank pressure contribute to 
the tank fragmentation process and the resultant debris size and 
impact footprint. Tlte TPS assures safe separation from the Orbiter 
and low altitude fragmentation to meet a required 100 x 600 n.mi. foot- 
print . 

The types, ureas of location and thicknesses were designed to 
handle worst case environments induced by an "abort-once-around : 
condition. Briefly the TPS materials and their application are as 
follows ; 

SLA-561 is used in two forms, molded (SLA-561m) and 
sprayed (SLA-561s). 

CPR-421 is a fluorocarbon-blown, rigid-foam 
(polyisocyanurate) . 

with strength characteristics, and dimensional and thermal stability 
at low or high temperatures, that exceed those of standard urethane 
foam. A more complete description of the TPS usage is shown in 
Table 9-1. 

9.1.6 Interface Hardware 

The External Tank interfaces with the two Solid Rocket Boosters, 
the Orbiter, and with the launch facility. SRB interfaces are six 
flight-separable structural attach points and electrical connections 
to allow Orbiter- to-SRB communication and control. Orbiter inter- 
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faces Include three flight separable structural attachments as well as 
electrical, propellant and pressurization umbilicals. A launch fa- 
cility umbilical interface located at the intertank provides ground 
services to purge the intertank and to actuate vent valves for pre- 
launch operations. A more detailed description of the interfaces 
can be found in Figure 9-1. 

9.1.7 Rang Safety 

Because of incompatibilities between the Shuttle baseline range 
safety system and the Air Force Eastern Test Range safety requirements 
a decision has been made to implement a new baseline Flight Termination 
System, which includes an External Tank propellant dispersal system. 

It will be carried on operational flights as long as required. The 
system will be "triplex" in that charges will be placed in the Ex- 
ternal Tank and one in each of the SRB's. The details of the exact 
system design are still under consideration. Trade studies are now 
undertifay regarding: £T electronics redundancy versus cross-strapping; 

intertank ordnance versus linear tank length charges; SRB charge; and 
redundant open- loop versus closed-loop dual initiator. 

9.1.8 Schedules 

A brief look at the Level I (NASA Headquarters) controlled mile- 
stones for the ET identifies the program's accomplishments and the 


261 


work ahead. 


- Completed Preliminary Design Review (PDR) 

- Completed Critical Design Review (CDR) 

- Complete delivery of Main Propulsion Test 
Tank to NSTI. 

- Complete delivery of KT (Jround Vibration 
Test Article to MSFC 

- Deliver first flight tank to KSC fcr MOFT 


Sept. 1974 
Nov. 1975 

May 1977 

March 1978 
Sept. 1978 


9.2 Observations 

A general overview of the ET program indicates that the program's 
management systems have been in place and working well for some time 
now. The basic detail engineering design/drawings are about 75% com- 
plete with full assembly and installation release due sometime in the 
third quarter of 1976. A study has been in progress for some time to 
determine if the Structural Test Article test requirements can be 
simplified and reduced, Tnis, of course, is a cost/schedule saving 
procedure which involves an analysis of what each test returns for 
the money and time invested. Many of the actions (RID's) from the 
CDR are still being worked, while all those from prior milestone, re- 
views have been closed. Manufacturing facilities (plant, tooling, 
etc.) and procurements of materials and effort appear to be support- 
ing the ET program at this time. .-Jpecific areas of concern and 
efforts to resolve them are discussed in the following segments of 
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this section o£ the report. 


9.2.1 Review System 

With the completion of the External Tank Critical Desl^'n Review 
In November 1975, the ET program Is considered sufficiently mature 
to allow fabrication of the deliverable tanks for flight. Tlie re- 
view established a baseline configuration. Almost all changes will 
need to be approved by MSEC, In addition to the day-to-day activities 
normally conducted at both MSEC and at Martin Marietta, regular reviews 
and Shuttle Panels dealing with the External Tank continue to be the 
major technical management control exerted on the program. Reviews 
include the ET Quarterly Technical Management Review conducted at 
MSEC or the Michoud Assembly Facility (MAE), weekly teleconference 
meetings to examine problems and expectations, and the Configuration 
Control Board operations. Further discussion of what transpired at 
the CDR will be helpful in understanding the depth of the reviews 
conducted on the ET. 

The CDR was conducted at the NASA Michoud Assembly Facility, in 
New Orleans, Louisiana, between November 10 and 21, 1975. Tliere 
were a total of 363 Review Item Discrepancies (RID's) submitted. 

These were distributed as follows: 


Structures 

129 

Propulsion 

77 
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Total » 363 


Electrical 

98 

TPS 

59 


Of those RID's 81 were withdrawn, combined with others or disapproved, 
leaving 282 "working" items. More than half of these have been closed 
out since the GDR by completion of the work or that the activity is 
fully in process. The remainder are being worked with expected 
completion before mid-year 1976. 

The CRD may then be sutnmarifsed as follows : 

(a) Structures and propulsion system design has been 
thoroughly reviewed and found to be technically adequate. Production 
can proceed with baseline design. 

(b) The TPS baseline concept has been found to be tech- 
nically sound. Development can continue on that baseline. 

(c) The electrical system componentvS review has highlighted 
three hardware problems - (1) Cryogenic Connectors (Low Temperature 
Limitations), (2) Ullage Transducers (High Temperature Limitations), 
and (3) Instrumentation Sample Rates (MUX Impact). 

(d) MPTA (Main Propulsion Test Article) requirements re- 
quire further iteration to match the requirement to vehicle capability. 

The action items resulting from the CDR included such things as: 

(a) The contractor (MMC) is to perform a cost trade study 
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on Che use o£ Inconel 718 for the aft SRB thrust fitting, Ttiey are to 
consider the procurement schedule to determine if it would be less 
costly to change out the material than to continue with the develop- 
ment cost of a titanium fitting. 

(b) JSC is to assure that adequate handling and logistic 
plans exist in support of the MGVT. 

(c) Rockwell International, Space Division, is to investi- 
gate the problem of overheating of the ullage pressure sensors. MMC 
is to evaluate other components for compatibility with the predicted 
gaseous oxygen temperatures. This will apply to both the flight 
vehicle and the MPTA. 

(d) MSFC will review Volume X of the Level II requirements 
documents and SN-C-005 (contractual specification) and initiate the 
appropriate change request to make the External Tank contamination 
requirements compatible with the system contamination control re- 
quirements . 

There are a number of major Level II working Panels that deal 
with the External Tank as it relates to (1) the integrated propulsion 
system (SSPM Directive #24), (2) Range Safety (SSPM #42), and (3) 
thermal design (SSPM Directive #46) and so on. Since these Panels 
meet and discuss technical and management problems on a continuous 
basis, they support the day-to-day operations as well as the major 
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reviews such as the CDR, 


9.2.2 Design ProKress 

Tl\is section will focus on two areas of ii\terest - (1) those 
design areas that are significant to the operation of the Space 
Shuttle System as a whole but which have received a minimum ol atten 
tion from the Panel before, ai\d (2) significant concerns regarding 
design requirements, design implementation, redesign due to test. 

The test program and its status is covered in another .section of 
this chapter. 

9 . 2 . 2 . 1 ET Venting ai\d Tumbling 

A liquid oxygen venting system is incorporated into the KT. Along 
with its associated tumbling system, it is designed to enhance the 
separation safety between the Orbiter and the ET. Tlie vent system 
relieves the liquid oxygen tank pressure if it increases to 23-25 psig, 
Tlie nearly nonpropulsive design limits thrust to less than 50 pounds. 
The liquid hydrogen tank may vent after separation if the tai\k reaches 
a pressure of 20-22 psig, but its direction of thrust will not affect 
the tumbling motion, 'fhe tumbling system associated with the liquid 
oxygen venting system operates by opening a pyro-operated valve in 
the nose cap. This allows the oxygen gas to escape through a single 
port located such that its thrust moves the nose of the External Tank 
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away from the Orbiter at a slightly greater rate chan the rear tank 
movement to create an increasing rate of tumbling. This energy is 
not related to the function of separation. The tumbling motion con- 
tributes to a more predictable trajectory by preventing atmospheric 
skip, and helps cause the External Tank to break up into fragments 
at about 185,000 feet altitude. This technique of entry results in 
a smaller, more predictable ocean impact area of about 100 x 600 n. mi. 
for tank pieces. 

9. 2. 2. 2 Flight Test Configuration 

The first six External Tanks to be used in the Space Shuttle 
Orbital Flight Test Program (OFT) have additional development flight 
instrumentation (DFI) over and above that to be used on the operational 
vehicles. These are installed to confirm the External Tank design, 
provide for diagnostic analysis to analyze flight anonuxlies and support 
operational planning. The instrumentation has been added with a 
minimum of changes being made to the base vehicle. The changes in- 
volved segments of the structure, the propulsion, electronic con- 
ditioning and thermal protection systems. An additional Orbiter/ET 
interface has, however, been added. The DFI electrical system, 
supplied by Orbiter power, consists of 342 measurements including bus- 
voltage monitoring and PCM multiplexer BITE monitoring as well as hard- 
ware for signal conditioning to assure a compatible data interface with 
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the Orbiter. The DFI measurements interface with the Orbiter Fre- 
quency Division Multiplexer. Measurements associated with POGO, 
acoustic and other vibration measurements interface with the Orbiter 
through the P7T frequency modulation multiplexer to tape recorders. 

9. 2. 2. 3 SRB Tlirust Panel 

The interbank cylindrical structure consists of two machined 
thrust panels and six stringer stiffened panels joined mechanically, 

No weldments are used. The two thrust panels distribute the con- 
centrated axial SRB thrust loads to the LOX and liquid hydrogen tanks 
and to adjacent interbank skin panels. The panels are selectively 
machined with tapered skin thicknesses, and 26 external parallel ribs 
are integral with each panel. The panels are machined from aluminum 
plate, 2219-T87, to a finished siae of 2.06" x 130" x 271" height. 

This panel must then be formed into the 165" radius after machining. 

It contains thicknesses ranging from 2" around the SRB Beam to 0.135" 
in the web sections, AVCO, the subcontractor, planned to hot- form 
those panel at about 375° in their "Bump Press." Because these panels 
are already in the so-called "T87" condition no temperature higher than 
325° is actually allowed. Given their experience on another contract, 
AVCO indicates that if the hot-forming is to take place at 32f/’ F. the 
panel will break. The options under consideration are: (a) ship the 

job to Denver Martin Marietta where there is a "Break Press" of suffi- 
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dent size, or (b) consider changing the material to the T37 con- 
dition for the fabrication process and then age it to the T87 con- 
dition, A decision has not been made and the Panel will follow this 
item. 


9,2. 2. 4 Range Safety Implementation for the ET 

The following tentative agreements have been reached regarding 
that portion of the range safety flight termination system that is 
to be designed for the External Tank; 

(a) The range safety system will be triplex (one per SRB, 
one on ET) . 

(b) ET electronics for this system are to be on the ET. 

(c) It is assumed that the External Tank termination 
system may not be required on all launches, and will be designed for 
easy installation and removal at the launch site. 

(d) MSFC is determining the desirability of locating the 
ordnance in the intertank area versus running a charge the length 
of the ET. 

(e) Studies are being made on the best way to achieve 
system redundancy. Redundancy is not required if the system is "cross- 
strapped" from the SRB system. So far these studies indicate there is 
inadequate antenna coverage during the early part of the ascent flight 
to support redundancy requirements. 
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(f) Requirements in Volume X of the Level II Shuttle docu- 
ments will be changed to meet the "triplex" requirement. 

'Ihese actionp and their implementation will be followed by continuing 
Panel attention. 

9 . 2 . 2 . 5 Structural Loads Updating. 

In November 1975 the Orbiter/lntegration Contractor generated 
new structural loads indicating that there will be significantly 
higher liquid hydrogen tank body loads as a result of time phasing 
of the moment and lateral load combinations. In audition when newer 
High-Q cases are examined it would appear that High-Q loads will in- 
crease the interface loads. As a result it would appear rhat either 
a higher pre-pressure or structural beef-up may be required. This 
area is under study at this time and will also be followed by the 
Panel in future examinations of the ET. 

9 . 2 . 2 . 6 Pulse Code Modulation (PCM) ftaltiplexer (MUX) Capability 
Current data requirements are close to the limits of the hard- 

wai'e to accommodate the data bits. Tlie PCM Mux capability is 16,000 
BITS with current usage at about 15,500 BITS. The potential for 
overload is obvious. Such a problem is not uncommon at this stage 
of the program. Scrub-down of the requirements for measurements and 
sampling rates is currently underway. This area will be examined 
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aC future reviewi by the Panel. 


9. 2. 2. 7 Weight Statue 

The EX current Inert weight la calculated or eatlmated to be 
73,756 pounds. The specification weight at this time is 73,999 
pounds. The margin is obviously email and will continue to require 
stringent management attention. The weight status is based principally 
on calculations and less than 15% is estimated. 

9. 2. 2. 8 Thermal Protection (TPS) 

A number of significant issues have surfaced and are in various 
stages of resolution at this time. Some of these are of particular 
interest to various Panel members and therefore are discussed here. 

(a) Rockwell indicates that revised ascent heating loads 
are somewhat higher than used by the ET designers in their design of 
the TPS. RI is currently evaluating their latest calculations of 
ascent conditions. These calculations, along with further high 
energy plasma arc/wind tunnel testing, should provide a more accurate 
picture of the thermal and structural load provisions to be made for 
the ET. The greatest effect appears to be on the forward section 
of the liquid oxygen tank and on the intertank. There is less im- 
pact on the liquid hydrogen tank. If the loads are higher there will 
be substantial increase in the amount of insulation required and a 
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corresponding growth in weight. Both the trajectory parameters and 
the analysts methodology using lower altitude trajectory, wind tunnel 
data recovery factors, and roughness effects are under review. 

(b) There is possibility of the lift-off of Che CFR-41'1 in- 
sulation at Che Intertace between the CPR insulation and the so-called 
"super light ablator" material. This would be due to the heat of re- 
action from CPR in liquid phase expanding the volume of air in the 
ablator material. Tlte pressure increase forms voids at the inter- 
face, of Che two materials which then bubble out. There is also a 
possibility that the CPR-421 interacts with the adhesive and primer 
used to hold the insulations to the tank. I’inally, the angle at 
which the two materials interface may result in aerodynamic lift-off. 
All of these areas are being studied and appropriate tests are under- 
way. 

(c) Material development and installation methods are 
still causing some problems. 'Hie lou str iigth of thick SLA-561s at 
Che substrate is under Intensive study and test to resolve this 
material problem. 

(d) Minimiaation of damage to the Orbitcr TPS tiles from 
ice on ET protuberances is receiving intensive study. There are more 
than 70 that can collect ice. Studies focus on reducing ice formatioTi 
to a minimum by further protection of the ET areas of concern and 
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understanding the tolerance oi the Orbiier tiles to damage irom iti- 
Impact Including the extent ol tile thermal degradation. 

9. 2. 2.9 Lightning Protection 

Tlie KT design incorporates features to protect the structure and 
subsystems from the direct and indirect effects ol triggered atmos- 
pheric electrical discharges during flight operations, 'llie KT is 
designed to function after an initial strike oi 200,000 amperes 
peak at the KT lightning rod and a second lightning strike of 50,000 
ampere peak across the KT body while it is in motion. Lightning pro- 
tection criteria for the Space Shuttle Program are found in detail 
in the document JSC-07636 with changes 1 and 2 updating it to March 
1976. Lightning protection is provided by the launch site until 
liftoff. Tltereafter, the bare 20 inch long, 20 degree nose cone 
at the tip of the KT nose cap serves as a lightning rod. Preliminary 
lightning tests indicate that a 0.03 inch wall-gauge gaseous oxygen 
line running along the outside of the tank can accommodate restrike 
currents with a fciward motion as low as one foot per second. Kurtht*r 
lightning tests are being conducted to confirm the design. Simulated 
lightning tests indicate the minimum (0.08 inches) the skin g,aug,e 
on the liquid oxygen tank will withstand expected strike currents. 

9.2.3 Major Ground Tests 
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There are three major ET ground test programs, or better still, 
three programs using the ET as a major test item: (1) Structural 

Tests, (2) Main Propulsion Test, and (3) Ground Vibration Test. 

Structural tests will be performed at the MSFG facilities to 
confirm structural analyses and to verify the design. The general 
objectives of this program are: 

(a) Verify structural integrity of the ET for critical 
internal and external design limits, yield and ultimate loads. 

(b) Obtain data to substantiate dynamic and stress analyses. 

(c) Verify the structural integrity of the interface hard- 
ware. 

(d) Obtain influence coefficients (stress and deflection) 
for structural and functional characteristics. 

(e) Verify the structural integrity of the substructure 
and of primary structure bracketry. 

(f) Detemine growth capability for future missions. 

(g) Determine weight savings candidates for the production 

article. 

The hardware used for these tests has been designated the STA 
or Structural Test Article. It consists of the following major 
test assemblies; Intertank Static, LOX Modal, LOX Static, Liquid 
Hydrogen Static. One LOX tank and one LH2 tank simulator section 
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are used in conjunction with the STA elements. 

The Main Propulsion Test (MPT) program is to be performed at 
the National Space Technology Laboratory (NSTL) in Mississippi. It 
will assess and verify the integrated Space Shuttle main propulsion 
system performance. The MPT External Tank will be mated to a simu- 
lated Orbiter midbody made of boiler-plate, and a flight weight aft 
fuselage with the main engine cluster. The ET MPT article is flight 
configured with modifications to meet the. needs of the test. A 
total of fifteen test firings are planned with eleven being either 
full duration or approaching full duration. 

The ground vibration test (GVT) program at the Advanced Dynamic 
Test Stand at MSEC will measure frequency, mode shapes, and damping 
characteristics of the mated Space Shuttle vehicle. The GVT External 
Tank is a flight configured structural article that will be returned 
to MAP at che completion of the GVT for refurbishment and recycling 
into a production ET. The experimental results will provide a basis 
.for updating the ma.th model so that follow-on analytical studies 
will yield refined and more accurate data. Substantiated or updated 
coupled dynamic math models will provide more confidence in the 
Orbiter guidance and control system design, POGO analyses, structural 
load predictions, and flutter analyses in support of the first Space 
Shuttle flights. It is understood that a l/4-“Scale test program is also 
in the plans. 
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9.3 Hazard Analyses and Safety Cottcerns 


Both NASA and its contractors have developed a hazard analyses 
and safety program on the External Tank program that is working well. 
Typical products are the "Space Shuttle External Tank Critical De- 
sign Review Hazards Analysis Report" (MMG-ET-RAOl-A dated October 17, 
1975) and the "Space Shuttle Safety Concerns Summary Report" (JSC 90090) 
which includes the ET as a part of the total picture. The elements of 
the process used by Martin Marietta in arriving at risk assessments 
include; 

(a) Process of hazard identification, analysis and corrective 

action. 

(b) Review and evaluation of changes for hazards. 

(c) Trade studies. 

(d) Safety assessment summary 

(e) Catalogue of hazard and then resolution. 

The ET Critical Design Review summarized the hazards at that time 
and most of them are now resolved. 


SYSTEM HAZARDS 

Structures and TPS 19 

Propulsion and Mechanical 27 

Electrical 10 


Transportation and Support Equipment 
TOTAL 


_2 

58 (Most of these have 
been resolved) 
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To provide the reader an understanding of these hazards, the 
following were selected from the Summary Safety Concerns report; 

(a) The impact of ice forming and breaking away from the 
ET and impacting the Orbiter TPS. This was mentioned in previous 
sections of the report. 

(b) Tliere is no provision for draining the LOX and hydrogen 
from the ET except through the Orbiter feedlines and the propellant 
lines in the aft fuselage. The concern is that detanking during an 
emergency must be accomplished through a system which may be in- 
volved in the emergency. An emergency drain system is under con- 
sideration. 

(c) There may be post separation contact between the ET 
and Orbiter because of undesirable motions caused by post-separation 
venting. This is under study. 

(d) The flammability of the ET tank insulation and adequacy 
of the wire insulation are both under further review. 

9.4 Material to Update the Basic Information 

To assure the reader the most current information, this section 
has been established to include new, pertinent information developed 
by the Panel since the prior sections were written. This update adds, 
modifies or deletes previous data contained in this report. 
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9.4.1 Boundary Laver Tripping 

Analysis of the "yoke" fitting on the forward Orbiter-to-KT attachment 
indicates that the fitting will cause the boundary layer to be tripped 
on the Orbiter (laminary to turbulent flow) earlier than desired. This 
will result in an increased heat transfer resulting in increased material 
temperatures of perhaps 80 to 100 degrees F, The extent of this problem 
is still under study along with possible redesigns of the yoke explosive 
bolt hardware. 

9.4.2 Implementation Of Range Safety F.oquirement s 

The current design approach is to mount two conical shaped charges 
in the intertank between the U)X and LH^ tanks, along with the two 
antennas, two batteries and associated electronics. The development 
of a cost/effective method of implementing range safety is under study 
with the objective of establishing an acceptable level of hazard firom 
Space Transportation System operations and determining criteria for 
employment of a full or partial flight termination system. Total 
system definition and ET design requirements are expected to be established 
by August 1976. 

9.4.3 Thermal and Structural Loads 

Since thermal analysis data will not be available to support the design 
of the TPS for the External Tank the TPS design must include margins for 
any surprises. This may result in excessive weights and additional 
expense for TPS development now and further changes may be required a 
year from now when the revised heating data becomes available. The 
latest structural loads data (April 1976) may cause serious impacts on 
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the current ET hardware, in the intertank, hydrogen tank and inter- 
face hardware. If load relief trajectories now under investigation 
do not reduce the loads, the weight impact may exceed some 300 pounds 
and affect many pieces of hardware already designed. 

9.4.4 Ice Protection 

There are more than 70 ET protuberances which can collect ice. Steps 
have been and are being taken to alleviate this problem. The application 
of spray-on insulation (SOFI) has been examined and can provide ice 
control for about 85% of the surface area (=584 ft“) with about 83 ft^ 
remaining to be covered. The application of the insulation in these areas 
is somewhat more complicated than that for the remainder of the External 
Tank. Tolerance of the Orbiter and tank to the ice/frost accummulations 
during pad operations and ascent portion of the mission are still under 
assessment. 

9.4.5 Thermal Protection System (TPS) 

CPR 488 which is a reformulated CPR 421 deleting the cobalt is currently 
being evaluated. Preliminary results indicate that either may be used 
to provide the needed thermal protection. 

9.4.6 IPX Anti-Geysering System 

The test setup at Martin Marietta Corporation division at Denver, CO, to 
test the efficacy of the anti-geysering system is now in the final stages 
of installation and checkout. Baseline flow testing is scheduled to 
start soon after July 1, 1976. 
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ATTACHMENT 9-1 


Tlio tfuijor chnllongos on Uk' EKlGrn«il Tank ol ssalety 5;iqjufi' 
canor /iro thormal insulation, ion formation, the UfU' of U'flu.i 
elocHrical win- insulation in the liquid OKyqon tank, and 
provi .“.ions for control of rocniry. 

Re sponse t 

Thermal Insvila t ion 

(a) The nose of the LOX tank has been revised from a homi nphnr i <*a * 
to a double cone configuration to avoid bow shock reattachri' nt c>.i 
the ogive and thereby reduce the heating. Wind tunnel te.'it.ing, 
analysis or thermal data and dovolopmont testing of TPS maiorialn 
on coupons and subscale tanks are continuing to characterize the 
TPS properties . 


Ice Formati on 

(b) Tests have been run in the Eglin AFP envircmmental chaialicr 
using a 10-foot diameter tank inr.vilatod with CJ'K-421 of st’veral 
different configurations. Thc'« specific objective of tho.so tc/stn 
xs to determine for selected v/orst environmental conditions tlio 
thickness and density of ice/Irost. Other objectives were; (a^ i' 
verify the searchlight concopl* as a method to prf'vont ico/fto.st 
formation on TPS surfaces and (b) to domonstratf- the feasibi lity f ' 
using conductive paints to prevent ice/frost formation. Tost data 
are being analyzed. 

Teflon Electrical Wire Insulation 

(c) During the Apollo 13 investigation, a test program was run 
(according to procedures outlined in NHR 8060. lA, Test 4) on the 
teflon insulated instrumentation wiring used in the Saturn vehicle' , 
The results of this program showed; (a) that the Saturn hnrncs.s 
insulation immersed in LOX could not be. ignited by any elootrica] 
overload; (b) in gaseous oxygen, the Saturn harness could be ig- 
nited when overloaded by approximately 800 percent electrically ; 

(c) in the unlikely event of ignition, fire would not propogate 
through the feedthrough connector at the tank wall because the con- 
nector pins, rated at 7 amps, would fail open preventing propagation 
to the other side. As a result, no changes were made in the Saturn 
stages LOX tank instrumentation wiring. 

The smallest wire in the ET will* be No. 22 (except for 1/2-mil 
platinum wire in loading and liquid level sensors) . Maximum design 
current for the No. 22 wire is 2 amperes. The maximum current into 
the tank under any single failure in sensor or signal conditioner 
is 1.5 amps. The duration of current will only be long enough for 
the 1/2 mil wire in the tank or circuit components in the signal 
conditioner to fuse (open) . 

The ET Project plans to conduct configuration tests using ET hard- 
ware and worst case conditions to assure no hazard exists. 
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ATTACHMENT 9“1 (Continued) 


Contro) of UtM*ntry 

(d) Tin* ;u1opt'ion of non-pi upulsivo vonlinq v;il1 t*nr?urn tiqinnr.l 
|)n*ii\.il III t* Viroiikup duo t’O LOX und hydi tKfi'n l.ii'h riipl un*.';. Tin* l«u * 
liniiKI nl «i tuiiibliiiq ‘.yiitc'in utilaaiiuj a fiyro \m!vc* wUh hiH i il i 'U 
ai lOT/Oi )>H or fU’p.n.ilion will provide' tho nt'fi** i-.iry contnillod 
rooniry . 


Uk,U)fNAL PAGE IS 
Of' POOR aiJAivriY 
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TPS CONFIGURATION TABULATION 
! _lf;^HATtyAL I Tmf KNtSS^tWCHtS 1 





FIGURE 9-1 






10.0 SOLID ROCKET ROOSTKR 


10 . 1 Introduction 

Two solid rocket boosters (SlOi's) burn In parallel with the 
Orblter main propulsion system to provide initial ascent thrust. 
Primary elements o£ the booster are the solid rocket ntotor, forward 
and aft structures, the thrust vector control (TV(’)> operational 
flight instrumentation and recovery avionics, separation motors and 
pyrotechnics and recovery parachutes. Each 3RB will weigh in ex- 
cess of one and a quarter million pounds. 

The major milestones for the SRB project provide a perspective 
on the current status of the program and the work ahead: 

a. Delivery of the first machine finished case segment 
to Thiokol for filling is scheduled for September 1976. 

b. Tlte firing of the first solid rocket motor as part of 
the development test program is to be completed in July 1977. 

c. Hie SRB Critical Design Review (CDR) is to be held in 

May 1977. 

As further background the response from the Shuttle organization 
to the Panel's last Annual Report on the SRB is included as Attach- 
ment 10-1, 

For the purposes of both description and data reporting, the 
SRB section of the report is divided as follows: Project Management, 

Solid Rocket Motor, Booster Separation Motors, Structures, Thrust 
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Vci’Lor Cont roi, Floctrical/KU t'tronics/lnNt rumentat ion, Hi i ovory 


Equipmonf. , Rnnp,e ;?.i; Temination, Ground Support Equip- 

ment', Major Ground IVsts, and !K*voXopmeni Ti'st s, 

10 . 2 Pro lent' Mtinanemtuit 

Tlio GRlt overall de*siy,i’ ;md control is currently beiuK done by 
MSEC. Tlic project iiumay,ement system utill.’.ed by NAfJA and its major 
SUB contractors is similar to that used on other elements ot the 
Shuttle program, Tlu're are quarterly reviews conducted lor NASA 
management and technical personnel, with Llie most recent one held 
on April 1-2, 197»> at the MSEC. Periodic desii'.n reviews lor the 
major components ol the, SUB are conducted about once a month. Tele- 
cons and special raeeting.s are a normal part of the technical manaite- 
ment and working I'ngineer system. Tiie review sy.'item also includes 
il l i'gration reviews and program level reviews as ri quired. 

Recent additions to the list of major contractors working, on 
the SUB include: 

a. ftcDounell Douglas Astronautics Company will provide 
the structures sidisystem. 

b. United Technologies, (hemical Systems Division, 
will provide the Booster Separation ffotors. 

c. Moog, Inc., Controls DivisSion, will provide the Thrust 
Vector Control Actuator. 
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(li) Bendix Company of Tetorboro, New Jersey, will provide 


the Inienrated Electronic Aaaerably. 

The Martin Marietta Co. has been selected aa the recovery system con- 
tractor. Plans are underway to acquire the Booster Assembly Contractile (BAC). 
Hie intent of MSEC Is to phnseover the loe,i sties and oper.itlons 
planniny^ as well as other assembly intey.ration tasks to this con- 
tractor starting in the last half of 1970. Tlic UM* has been issued 
and a contractor will be selected around mid-year. 

10 . J Observat ions 

10 .1.1 Welr.ht 

Tlie SUB weights are of course important. Since there are two 
units weight increases on the SRI) have to be doubled to appreelav.o 
their impact on the total Shuttle. Tlie table below shows the weig.ht 
statistics : 

SUB X 2 = 365,454 pounds inert specification control x>?eiKht 

- 357,738 pounds is the current inert weiuht- 

== 7,716 poum's margin 

= 2,586,034 pounds total control weight 

« 2,220,580 pounds solid propellant weight 

The available margin for the SRB’s is roughly 2 , 27 . on the inert weight. 

This is a somewhat tight figure at this time considering the 
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po88iblo >',rowtU due to deHi.^',u additions and modiJ icat ions I’esult- 
tnK iirom the developnHnt lest profU’am. 

10. i. a BoUu Koekot Mofor (.SKM ) 

‘Ilie solid rorkft isioii»r i,*: ntoi’i* than !?'> i»'i { loin' and 12 It et 
in diameter. 'Ihe solid propellant is east and umd in lour easting, 
sofitnents wliid. art transported by rarl to tin* launeh ;ute wlv» re 
they are to be astnmbled Into the t ini shed nk»tt>r. Tne ;iRM pro- 
pellant is the same type as that usetl in the boseldou and the I'irst 
!>ta>»e Minuteiaan motors, 'iln* noaele is nt*arly I'i Itet lon^t and is 
also 12 feet in d.aineter at the enit. It woii.’U8 nearly 11 tons. 

A key feature ot this no.;. ’It* is a tle::ible bearlnr, eonstructed of 
e.lternate layers tif elasiromirie rubber ami steel whieh permits the 
no:;;;lo to be tiiwhaled and delleeletl tor ;tl t i Lude eoni rol ol the 
shuttle yystem duriny, aseeni portion oi the mission, llie HBM 
iy,ntter mounted in the ln*ail ol the motor weif'hs al)out t)f)0 pounds 
and Is l.'iryer than many tactiial roeket nwtorn. The i>',niter eon- 
slsta ol a safe and arm diviee, a pyroj'.en initiator, and the main 
pyroyeu iyiiiter. 'Ihe UHM's .are de.';i;',ited to burn lor about lv;o 
minutes eurrylttr, the Shuttle ( luster l(' about, .il> miles altitude 
after whieh the .SRB will separate, paraelmte to the (teean for re- 
tawery and i*euse. 

The HRM is deep in the phase of component design, development, 
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and testing. The SRM Critical Design Review (CDR) is set for mid- 
1977. The ground tests of interest include the following: 


(a) 

Subscale Flexible Bearing (Nozzle) 

Completed Successfully 

(b) 

Prototype Hex Bearing Tests 

December 1976 

(c) 

Ignition System Development 6e Qual 

February 1977 

(d) 

Ignition Safeing and Arming D & Q 

Mid- 1977 

(a) 

Case Hydroburst 

September 1977 

(£) 

Nozzle/TVC Confirmation 

.‘.>cember 1977 

(g) 

Railroad "Hump" Test 

Mivl-1978 


To accomplish the program the following types and quantities 
of motors are being produced: four development motors, ' ree qual- 

ification motors, and five ground test motors. Two of the ground 
test motors are inert - two are empty and one is for structural 
Lest. In addition, the present schedule includes six flight motors. 

The motors will be used in the following test schedule: 

(a) Development firings Number 1 July 1977 

Number 2 September 1977 

Number 3 February 1978 

Number 4 April 1978 

On the Number 2 and 3 firings the same refurbished case will be used. 

A refurbished nozzle and flexible bearing will be used on the Number 4 


C, 
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development firing while the number 3 firing will use a non-re lur- 
bished or used flexible bearing. 

(b) Qualification Firings Number 1 July 1978 

Number 2 August 1978 

Numl)er 3 December 1978 

On the Number 1 and 3 qualification firings the same relurbished 
case will be used. 

10.3.2.1 Design Loads 

■fhe magnitude of the flight and water impact loads and the 
resultant attrition rate or loss of the SRB's during recovery is 
of concern because of the effect such losses have m\ the cost per 
flight figures Cor the Shuttle mission. Tlie design load consider- 
ations for reuse of the SRB directly affect the SRM. Tl\e SItM case 
is designed for the maximum expected operating pressure. Tlie noei’.le 
and aft skirt are subjected to support loads from the launch pad, 
reentry acoustic (orgatx pipe effect). Tlie aft end of the SRM is 
designed for water impact and the water cavity collapse loads after 
the rocket strikes the water. 

The major concern regarding design loads has centered on the water 
impact loads. Originally, the project anticipated a water impact lo.ad 
based on 100 ft/sec vertical velocity. As a 'result of analysis and 
model tests by MSFC, their contractors, and other federal agencies, 


289 


the project haa determined that; a vertical velocity of 85 ft/sec 
is more realistic , This means a reduction in total program cost, 
reduced risk of losing an entire SRB during entry, and a more 
acceptable weight margin. The change in expected attrition rates 
is shown in the following tables 

Water Impact Attrition For 85 ft/sec 

85 ft/sec 100 ft/sec 


Aft Skirt 
Aft SRM Segments 
Forward SRM Segments 
SRM NoHzle 
TVC Actuators 
TVC Power Supply 
No attrition analyses have been 
than three (3) parachutes* 


7,2% 

O 

o 

1.3 

9.5 

1.9 

1.3 

3.6 

7.0 

8.3 

12.5 

3.6 

10.0 


done on a configuration using 


less 


10.3.2.2 Case Heat Treat 

Shuttle SRM components are unique in Chat they will be recovered 
and reused again and again. Tliis requirement involves complex 
strength requirements in both material fracture toughness and ten- 
sile properties. Considerable effort is being expended in base- 
lining a heat treat process to achieve the proper mechanical prop- 
erties. Tlie work so far shows that the heat treat profile used 
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producea acceptable tensile propettiea in all materials tested to 
date and the heat treat has produced acceptable toughness properties 
with the exception of one questionable sample. As a result the baseline heat 
treat profile appears acceptable for meeting the Sid*! case material 
mechanical requirements. 

10.3.2.3 Corrosion of the SRM Case 

Essentially, the SRM is a segmented stack of large cylindrical 
shells made from D6AC steel, Joined together by a clevis arrangement, 
and fastened with MP35N pins. The SRM case design is such that it 
should prevent corrosive attack, accelerated galvanic corrosion, 
crevice corrosion, and stress corrosion. The optimum scheme for 
joint protection will be determined based on results from tests 
where parts are immersed in flowing seawater. Tlie majority of the 
case is to be. coated with organic films of proven protective cap- 
ability and the joints will use a sealant and an organic barrier 
combination. 

It has been rocognir.ed that the female portions of the clevis 
joints present the greatest uncertainty regarding protection. Tills 
uncertainty has been taken into account as far as possible and such 
joints will receive special attention during assembly and be sub- 
jected to non-destructive test techniques. 
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10.3.2.4 Thru8t"Tlme Shaping 


'rhiokol Chemical was directed by MSFC to provide a support 
study on SRM thrust-time (perl'omumci ) shaping to the Rockwell Inter- 
nationa, Space Division, Tliia thrust- time study involved grain de- 
sign and inhibiters. Hie studies indicated that through the per- 
i'ornumcc-shaping it would be possible to desensitise key ascent i light 
parameters and reduce flight load problems. Tliesc requirement 
changes occurred after the base-lining of the SRM design and there- 
fore will have an effect on the SRM schedule, cost and lacilities, 

'flve changes to the SRM propellant will have only a minimum impact 
on the SRM program. 

10.3,2.5 No'.e.’.le I’lexible Rcar inn 

'file SRM noaale design is showii in Figure 10-1. 'nie flex boar- 
ing is a noaale subassembly which gives a - 8 degree omnidii*ectional 
thrust vector control capability to the SRM. Sub-scale testing of 
this flex bearing indicated nuiterial problems that would have to be 
resolved prior to the fabrication of the, full-scale unit scheduled 
for testing at a later date. 

The problem appears to be in the use of the elastomers (rubber 
material) and their stability during processing ol the bearing it- 
self in the hot-mold process. Studies to date have identified four 
candidate elastomers that appear suitable for SRM flex bearing use 
so that there should be no real difficulty in building and success- 
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tully testing n prototype bearing. 

10.3,2,6 lanltlon Syatom 

The ignition system is large and somewliat sophiaticated. l-'igure 
10-2 shows both the igniter assembly which has a large quantity oi 
propellant and the safe and arm vinit which is a motoric.ed assembly 
to open find close the ports used to ignite the system. Testing and 
development of this component is currently in full swing and will 
bo monitored by the Panel. 

10.3.3 booBte.r Separation Motor 

To meet the SRB separation requirements listed below it was 
decided that small rocket motors would be best in translating the 
SRB away from the Orbiter and External Tank at the desired Lime in 
the Space Shuttle ascent trajectory. 

Ihose requirements include the following: 

(a) Separation of the SRB should preclude damage to or 
recontact with other Shuttle elements during or after separation. 

(b) Exhaust gases from the rocket motor's separation sys- 
tems should not cause damage to the remaining Shuttle elements which 
would require repair or replacement of the Orbiter TPS. 

(c) Installation of the separation motors shall be in the 
SRB nose frustum and SRB aft skirt. 
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(d) Release oT nil structural attachments shall occur 
within 30 milliseconds and the thrust of each set of BSM's shall reach 
55,500 pounds of thrust in each set within 30 to 135 milliseconds of the 
separation command. 

(e) Tlie desij;n should provide lor sale separation ior 
angles oi attac... and sideslip over a range, ol - 15 degrees including 

the rates and dynamic pressures wliich follow, nie maximum dynamic 

Hh 

pressure shall be 75 pal and the nuiximum rates shall be - 2 degrees 
per second in pitch and yaw. Tliese rates and dynamic pressures will 
be sense.d or computed by the Orbiter and when exceeded shall inhibit 
Che separation of the SRB's. 

The status of motor development indicates that there are no 
major concerns on this project. Tlie. propellant has been baselined 
and characteriaed. Detailed design drawings and preliminary analysis 
reports have been completed. Tlie PDR was conducted in February I97(> 
and motor case fabrication has been initiated. Further definition 
of the interface between the Booster Separation Motors and the 
SRB/ET/Orbiter are required. Tlie exact nature of this definition 
is not known at this time. 

By mld~1976 testing of the igniters should be comple.ted. The first 
four test motors should be completed by mid-Janu.ary 1977. Qualification 
is set for 1977 and the delivery of the flight hardware is set for 1978. 
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10>3«4 Integrated Electronic A«>emblv (J£A) 


The lEA syatem utilizes orbiter power for the Orbicer data bus. 
It provides support to the following SRB functions: 

(a) Thrust Vector Control (TVC) Subsystem 

(b) Development Flight Instrumentation 

(c) Range Safety System 

(d) Recovery System 

(e) Shuttle Flight Control System (through the Orbiter) 

(f) Separation System 

(g) SRM 

Figure 10-3 shows the IKA unit in simple detail. There are 
actually two types, one mounted in the forward skirt and one mounted 
with the aft External Tank attach ring. Both are watertight. Tlicy 
weigh about 190 pounds ready- to-go and are about 12" x 13" x 45" in 
size. The PDR was completed in December 1975. Mockup vibration 
testing is underway, and stress corrosion susceptibility studies 
have been completed. The only concern is the lead time required for 
the procurement of the watertight connectors for the units. 

10.3.5 Structures 

This area includes all of those structural items that tie the 
various subsystems together - the aft skirt, ET struts and attach- 
ments, systems tunnels, forward skirt, forward ordnance ring, tow- 
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ing pendant, altitude sensor assembly, Jrustum assembly, nose cap 
assembly, and flotation installation, ‘rhie program is in a very 
early stage and will be reviewed by the Panel as it evolves in the 
tuture . 

10.4 Range Safety System 

This has been partially discussed in the section devoted to 
the External Tank. Tlierefore only that portion of the Siinge Saiety 
Plight Termination system dealing with the SRB is covered here. It 
was determined that a conical shaped charge was no long.er needed 
in the nose cone of the SRB, and that the SRB would use a linear- 
shaped charge along 10% of the SRii portion of the SRB. Such a 
charge would be placed on either side of the SRM, Tliis system is 
to be. applied to both the SRB's. Tlio specified requirement in 
Volume X, JSC 07700 will now state: "The SRIt's shall be provided 

with grovmd- commanded systems to destruct the SRB's. System com- 
ponents shall be reusable j'here cost savii^gs will result," 

Trade studios are currently being conducted with regard to the 
use of a redundant open-loop initiator versus a closed-loop dual 
initiator. Closed-loop refers to the initiation of the charge from 
both ends, while open-loop means setting the train off from only one 
end. The Panel will follow the evolving system to assure that the 
decisions being made receive appropriate management attexation. 
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10.5 SRB Reuaa 


Th« rausft requlrsmants "drive" the design of the SRB and its components 
The total number of times the components are used is as follows: 

(a) Structures (excluding nose cup and thermal 


shield) 40 

(b) Tltrust Vector Control 20 

(c) Electrical and Instrumentation (excluding 

batteries, lights, exposed cables) 20 


(d) Recovery System (parachutes, et.al.) 10 

(e) Solid Rocket Motor (except as below'4 .20 

Flex Bearing M.aterials (elastomers) 10 


Nozzle Ablator Material 1 

0-*Ring Seals 1 

(f ) Pyrotechnic Devices 1 

(g) Booster Separation Motors 1 


Specific design features to assure reusability include the use 
of protective coatings over a relatively small percentage of the SRB, a weld 
free SRM case, watertight compartments for electrical/eleetronic/in- 
strumentation installations, stiffening rings for water impact loads, 
flexible aft-skirt heat shield, and similar design items. To achieve 
the design requirements a good deal of effort continues to be expended 
on the case heat-treat process, Thermal Protection Subsystem materials, 
the paints and sealants, and flotation materials. The status of these 
areas is to be monitored during the Panel’s future reviews. 

Decisions on the reuseability of a piece of hardware will, of 
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courie, depend on what wean o\x*’ wim cauaes an item to be con- 
sidered worn-out. The point at wl;ich a piece ol hardware is con- 
sidered worn out is not a discretely defined point but will result 
from the cumulative effects of exposure to environments and handling,. 
Loss from water impact damaRC is the most significant attrition 
factor. Retrieval operations once the SRB is in the water poses the 
next major possibility for losing it since there can be problems lo- 
cating the vehicle or towing it; al^o, there is the possibility of 
storms severe eitough to preclude retrieval or damage the vehicle 
while in the water. Other factors that would preclude reuse of 
specific ittms include: 

(a) Structures - wearout or damage due to accumulated 
dings, dents, and corrosion. 

Recovery - excessive parachute ribbon damage from 
inflation and retrieval. 

(c) Electrical and Instrumentation - Mechanical fail- 
ures, e.g., cracked solder joints, broken wires, "drift" of piece 
parts. 

(d) TVe - Failures iii tlu‘ actuator rod end bearing; the 
power supply flex hoses, valving, exhaust ducting, pumps; as well 
as general corrosion. 

(e) SRM - Accumulated abnormal loss of metal from grit blast 
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preparation durlt^g refurbiahnent. 


10 . n Teat. Program 

The SRB will be qualitled at the motor level (f RM) in addition 
to the normal qualification ol components. Because it la a recover- 
able and reuaeable item there are special teats not required on 
other elements of the Shuttle program. 

The common structural testa conducted on all segments ol the 
Shuttle vehicle are a part of the SRB test program as well. Tliese 
include static structural tests to verify material selection, vali- 
date stress analyses and design margins, etc. Dynamic model surveys 
w.‘ll provide data on dynamic model analysis. Separation tests. In- 
cluding full-scale tests of the separation motors, will verify de- 
sign and performance. Tlte SRB component environmental certification 
test requirements and methods arc included in the MSFC report "SRB 
Component Environmental Certification Test Requirements and Methods" 
SK-019-067-2H. Rather than discuss the details of this program in 
this report the reader should examine the MSFC test document itself. 

Finally, requirements for retest of the refurbished hardware 
is crucial to this program. 

Tlie test area will be a subject for further examination to 
assure that the confidence level achieved through the test program 
is of sufficient degree to support the first Orbital Flight Test 
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aa well aa aubaequent; miaaiona. 


10 . 7 Fracture Contrcl 

There ia a very detailed fracture control program now in full 
operation. It is und»i.-tood that fracture control rcquiremenla nave 
been included in ail procurement packagea along with a requirement 
for fracture control boards , On October 8, 1975 the firat formal 
meeting of the MSFG/SRB Fracture Control Board (FOB) was held, Tlie 
SRB/FCB staffed by MSFC is responsible for the overall 8RB program. 

In addition there ia an SRM Fracture Control Board established and 
staffed by Thiokol which has been in operation for some time. 

To illustrate the work of the MSFC Board the meeting on Oecomber 
10, 1975 reviewed the Booster Separation Motor (BSM) Fracture Control 
Plan. 'Axis review covered tue FCB's organiisation and responsibilities 
and the implementation of the fracture control plan at the contractor 
with particular attention to part selection lofdc and tbo dosign/aiial- 
ysls, fabrication and test* procedures. 

An example of the hardware placed under fracture control is 
seen in the Thiokol FCB activities. Tliiokol has reviewed the 
various parts which make up the SRM and, based on fracture control 
selection logic, has made a determination of the fracture critical 
items. Tlie items which have been identified for fracture control 
are the case segments, igniter chamber and adapter, and the nozzle 
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stationary shell and flex shims. These items, in most cases, have 
high tensile stresses. However, the selection process gave par- 
ticular attention to the impact on mission success and program 
schedule if the hardware should fail and have to be replaced. Tlie 
clevis joint and the basic-part membranes are the most significant 
items on this list. More detailed fracture mechanics analyses 
have been performed on such parts to determine the expected flaw 
growth, critical number of cycles, stresses, and test proof factor. 
In particular, testing has been completed for the clevis joint to 
determine its mode of failure. The testing and analysis completed 
to date have shown that these parts can withstand significantly more 
cycles and higher stresses than expected during the actual mission. 

In additon to the fracture mechanics analysis, some stress 
corrosion work has been completed. Areas of investigation in- 
clude effects of material exposure to sea water, coatings, heat 
treating effects, and fracture toughness determinations con- 
sidering temperature effects. This work is to be supplemented 
with testing on forging sections, hydroburst testing, etc. 

A point brought up during MSFC FRB discussions with Tliiokol is 
important. They were asked what they would do differently in test- 
ing, traceability, inspection, etc., if a part was not under frac- 
ture control. The answer was that all parts of the SRM would be 
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subjected to the same rigor regardless of fracture control dispo- 
sition, Tlie prinary difference is the level of review for any item 
that is out of specification or is considered to have a discrepancy, 
Tlie MSFC/FGB is in the process of evaluating the need to place the 
SRM propellants under fracture control. Thiokol has not considered 
this necessary at this time. 

10.8 SRM "Burn Tlirough" 

Burn-through relates to the loss of case integrity because the 
propellant burns a hole in the case. Previous solid rocket exper- 
ience, particularly on military rockets, has been examined and 
applied to the design of the Shuttle SRM. Potential "burn- through" 
failure modes identified during the Panel's review were: 

(a) Propellant grain defects. 

(b) NoKsle ablatives. 

(c) 0-ring seals and clevis joints. 

(d) Internal case insulation. 

(e) Propellant inhibitor. 

(f) Forward case segment igniter bolt holes. 

(g) Propellant-liner-insulation-case bonds. 

Tlie design appears to be based on demonstrated concepts to 
preclude ease burn-through and there are adequate safety factors 
of 2:1 or higher to accommodate uncertainties. Kxtensive component 
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testing will be performed to validate this design approach. 

10.9 SRB Hazards 

The following listing is provided to indicate the typos and 
numbers of hazards on the SRB. Many of these hazards have been 
eliminated; others have been accepted by management based on a 
thorough review of the problem. Some are still being worked. 

SRB ignition overpressure 

Late ignition of one of the SRB's 

Failure of fore or aft BSM's 

Public hazard from impact of SRB (in work) 

Contingency abort capability with SRB (in work) 

IJmergency escape in flight 

SRB mechanical safe-arm device to be enabled in the 
VAB (in work) 

Kxcessive q-alpha and/or q-beta on Shuttle ascent 

10.10 Lightning Protection 

SRB equipment requiring protection includes the pyrotechnics, 

TVe sensors and switching circuits, integrated electronics assembly 
plus all exposed flectrical cables. The governing design document 
is the JSC-07636 Rev. A, dated November 4, 1975, "Space Shuttle Program 
Lightning Protection Criteria Document." Briefly the SRB nozzle 
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lif'.htnin^' design measures being taken include: sing,le point ground 

on power circuits, use of twisted wire pairs, 2 - 1/millisecoud 
delays £or switching functions, cable tunnel protection, multi- 
grounded overall h»"(ds on ordnance cables, and tests. Tlxis area 
will continue to iv .mitorod by the Panel. 

10.11 Addendum 

This is the period in the SRB development when requirements are still 
in evolution. A revised SRB Verification Plan (Volume IV, SE-01 9-019- 2H) 
has been released since the earlier sections were written. Some of the 
latest updates are to assure complete records on test programs, procedures 
and results. 

The "SRB Component Environmental Test Requirements and Methods" was 
issued in December 1975 as SE-019-067-2H. It establishes the detailed 
envlronment.al test requirements, test methods, and test criteria to be 
utilized in the environmental acceptance and certification testing. 

The SRB safe and arm device critical design review was conducted at 
the subcontractor's site in June 1976. Final closeout for the resulting 
actions is scheduled for July /August 1976. 
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ATTACHMENT 10-1 


The Solid Rocket Booster is in an early stage o£ development. Crit- 
ical areas must be monitored closely f.‘or the earliest possible de- 
tection and resolution of problems to assure that trade-offs provide 
for the maximum Space Shuttle system safety. Such areas include re- 
covery and re-use of the booster. 

RESPONSE ; Space Shuttle Program Management and especially the SRB 
Project Manager are sensitive to the areas affected by the reuse- 
ability concept. Special analyses arc continuing to maintain high 
reliability of the components and subsystems which are affected by 
planned reuse. In addition to the activities within the SR15 project 
at MSFC, a special SRB review function was established within the 
JSC Space Shuttle Systems Engineering Office to provide an 
independent assessment of the SRB design and development activities. 

This function includes review of subsystem designs (structures, 
avionics, recovery, TVG, etc.) as well as the refurbishment planning. 
This review group is involved in source selections for these sub- 
systems all the way from design through RFP preparation to participation 
in SEB's. They are currently assessing the design criteria for re- 
covery system parachutes and the planning for the parachute drop test 
programs . 

It is important to note that hazards to personnel involved in the 
water retrieval of the booster and parachutes are no longer a major 
concern, since divers are not now planned for the nozzle plugging 
operation. The Naval Undersea Center is developing an underwater 
remote controlled device to accomplish this without diver participation. 

In addition to these independent review activities, study teams have, 
been formed to establish refurbishment operations requirements for 
returning the SRB reueeable components to a flight acceptable condition. 
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FIGURE 10-1 












